CORS should not allow every resource to access Web Applications

What does the recommendation "CORS should not allow every resource to access Web Applications" check?

Flags any App Service web app whose cross-origin resource sharing list contains the wildcard origin '*', which tells browsers that script on any site may read the app's responses. It inspects the app's CORS allowedOrigins under site config, so a single '*' entry trips the control even if specific origins are also listed. It does not judge whether your named origins are correct, it does not check supportCredentials, and it does not cover CORS handled inside your own application code or by a fronting gateway such as API Management or Front Door, only the platform-level App Service CORS setting.

Why does "CORS should not allow every resource to access Web Applications" matter?

A wildcard origin disables the browser's same-origin protection for your app: any malicious page a signed-in user visits can issue cross-origin requests and read the responses, turning a CORS misconfiguration into a path for data theft and session abuse against an authenticated API. For a business this means customer data exposed through a third-party site, broken tenant isolation, and an audit finding that is trivial for a penetration tester to demonstrate. Restricting CORS to the handful of front-end origins that genuinely call the app removes that whole class of cross-site read.

How do I fix "CORS should not allow every resource to access Web Applications"?

1. In the Azure portal open the web app, go to Settings then CORS, delete the '*' entry, and add only the specific scheme-and-host origins that must call the app, for example https://app.contoso.com.
2. From the CLI strip the wildcard and add real origins: 'az webapp cors remove --resource-group <rg> --name <app> --allowed-origins "*"' followed by 'az webapp cors add --resource-group <rg> --name <app> --allowed-origins https://app.contoso.com'. In Bicep set the array directly via the app's siteConfig: 'cors: { allowedOrigins: [ 'https://app.contoso.com' ] }'.
3. To prevent regressions across the estate, look up and assign the audit policy by its exact display name rather than a hardcoded GUID: 'pid=$(az policy definition list --query "[?displayName=='App Service apps should not have CORS configured to allow every resource to access your apps'].name" -o tsv)' then 'az policy assignment create --name no-wildcard-cors --policy "$pid" --scope <scope>'. Note the built-in is AuditIfNotExists, so it reports but does not remediate.

SUB="/subscriptions/00000000-0000-0000-0000-000000000000"
RG="rg-app-prod"

# Harden every app that is not already HTTPS-only.
for app in $(az webapp list -g "$RG" \
    --query "[?!httpsOnly].name" -o tsv); do
  # 1. Force HTTPS on the site itself.
  az webapp update -g "$RG" -n "$app" --https-only true
  # 2. Turn off the remote debugger.
  az webapp config set -g "$RG" -n "$app" --remote-debugging-enabled false
  # 3. Drop any wildcard CORS origin (replace with your own origins after).
  az webapp cors remove -g "$RG" -n "$app" --allowed-origins '*'
  echo "$app: HTTPS forced, remote debugging off, wildcard CORS removed"
done

# Ratchet it shut: deny any future app that is not HTTPS-only.
# Look the built-in policy up by display name, never hardcode the GUID.
pid=$(az policy definition list \
  --query "[?displayName=='App Service apps should only be accessible over HTTPS'].name" -o tsv)
az policy assignment create \
  --name deny-appservice-http \
  --policy "$pid" \
  --scope "$SUB"