Azure Publish Setting Password

Detects Azure publish settings file password patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.

Type

regex

Engine

universal

Confidence

high

Confidence justification

High confidence: structurally constrained pattern matching publish settings credentials with specific XML attribute context reduces false positive rates significantly. Added context gating and exclusion rules improve precision and reduce incidental matches.

Detection quality

Partial

Jurisdictions

global

Regulations

Criminal Code Act 1995 (Cth)

Frameworks

CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2

Data categories

credentials, security

Scope

specific

Risk rating

10

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)(?:ManagementCertificate|userPWD|publishPassword)\s*=\s*"?[A-Za-z0-9+/\s]{40,}={0,2}"?

Corroborative evidence keywords

publishsettings, ManagementCertificate, publish settings, Azure, subscription, management certificate, publish profile, deployment, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie (+45 more)

Proximity: 300 characters

Should match

• ManagementCertificate="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" — Azure management certificate in publish settings
• userPWD="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890+/=" — Publish settings user password
• publishPassword="0000000000000000000000000000000000000000000000000000" — Publish password with placeholder value

Should not match

• ManagementCertificate="" — Empty certificate value
• SubscriptionId="00000000-0000-0000-0000-000000000000" — Subscription ID, not a credential
• template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

• Azure documentation describing the publish settings file format with example values. Mitigation: Check for common placeholder patterns and documentation context.
• Expired or rotated publish settings files that no longer grant access. Mitigation: Flag for review regardless since the file format reveals subscription details.

References

• Azure publish setting password entity definition - Microsoft Learn