Exposed/misconfigured admin interfaces

Info

ID: MS-TA7005
Tactic: Initial Access
MITRE technique:

Some cloud-based web applications expose administrative interfaces for managing deployments, configurations, or runtime operations. If these interfaces are exposed to the internet or misconfigured, attackers might be able to access them and view critical data, execute commands, or manipulate application behavior.

For example, if an Azure App Service exposes its Kudu interface to the internet, an attacker with sufficient credentials could execute commands in the app's environment.

Mitigations

ID	Mitigation	Description
MS-M7011	Disable basic authentication	If possible, turn off user/password authentication on administrative interfaces such as SCM endpoints, function management consoles, and deployment portals.
MS-M7012	Enforce multi-factor authentication (MFA)	Require MFA for access to all administrative and management interfaces.
MS-M7013	Restrict network access to sensitive services	Limit access to administrative endpoints using IP allowlists, private networking, or VPN requirements.
MS-M7014	Implement role-based access control (RBAC)	Ensure only authorized roles can access administrative features and interfaces.