Description

Detects Azure Search Services that are not configured to use managed identities for authentication. Without managed identities, services may rely on less secure authentication methods like access keys or connection strings, increasing the risk of credential exposure and compromise.

Detection Strategy

• Examines each Azure Search Service in the subscription

• Checks if the service's identity property is set to 'None', indicating no managed identity is configured

• Reports a vulnerability when a search service is found operating without managed identity authentication