Question

A retailer runs an e-commerce platform on Azure App Service (Linux Web App for Containers) and pulls images from Azure Container Registry. The security architect must design a posture and workload protection solution that continuously assesses the platform's TLS configuration, requires the App Service to use a system-assigned managed identity for connecting to Azure SQL (eliminating stored connection strings), and produces prioritized recommendations against a recognized security benchmark. Which approach best meets all three requirements with the least custom development?

Accepted Answer

Enable Defender for App Service and Defender CSPM, apply the Microsoft Cloud Security Benchmark, and remediate the managed identity and TLS recommendations surfaced in Secure Score.

Answer

Deploy an Azure Policy custom initiative that audits TLS versions only, and manually rotate the SQL connection string secret in Azure Key Vault on a schedule.

Answer

Onboard the Web App to Defender for Servers via the Azure Arc agent and rely on OS-level machine configuration baselines to evaluate TLS and identity settings.

Answer

Enable Defender External Attack Surface Management (EASM) to discover the App Service endpoint and enforce managed identity through EASM remediation workflows.