SmartScreen for Microsoft Edge - Reporting Azure Static Web App as unsafe?

[iancoetzer]

Hi
Whenever I create a vanilla Azure Static Web app, Microsoft's SmartScreen for Microsoft Edge reports the site as unsafe?
This is after I publish it to Azure and try and navigate to the URL provided by Azure?

How do I fix this so that my end users do not see that same horrid red page reporting my site as potentially unsafe and harmful?

If I purchase a domain name and associate that with my site would that solve this issue?

P.S We tested again today even a new static web app without any code published results in the same red page reporting the web page as unsafe?

Thank you

[nmahajanoii]

I also started getting the same issue. All my SWA where SSO is implemented only for within org a, all are unsafe

[iancoetzer]

Thanks for replying.

I have just started last week building sample Static Web Apps - using Blazor WASM with an API
But as I mentioned we created a new 'empty' static web app and the same issue

we tried the following but all lead to same 'unsafe' report by SmartScreen for Microsoft Edge only ...

1. we made sure the resource group as well as the static web app is hosted in western europe
2. we have another azure subscription - not in the org - and same issue

[KelvinTegelaar]

It seems somehow Microsoft got Identity5 - one of their SSO services added to SmartScreen. I've emailed their teams about this.

[iancoetzer]

Hi Kelvin
Thank you, I hope they can sort this out so that we do not have to purchase custom domains and certificates for this.

[iancoetzer]

Ok, I can confirm now what Kelvin says is true.

I purchased a cheap custom domain, managed to setup my Azure Static Web App with that custom domain.
Now the site works - no more unsafe site report ... UNTIL I try and sign-in with Github or AAD ...

when it hits the identity.5.azurestaticapps.net services for sign on ...

[joewashek-dmi]

Hello,
just bumping this, as I am having the same issue with auto-generated swa domains (i.e. azurestaticapps.net).

Last week it worked fine in Firefox, but not Edge. This week it doesn't work on either.

• Edge: This site has been reported as unsafe
• Firefox: Did Not Connect: Potential Security Issue...............azurestaticapps.net has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site

[iancoetzer]

when your site 'reports as unsafe' in microsoft edge
does it also refer to "identity.5.azurestaticapps.net"
or your actuall. blue-shell554455.net..... etc site?

[iancoetzer]

I think they fixed it as I am not receiving the this site has been reported as unsafe for identity.5..... or my custom auto assigned domain names - azure static web apps.

[joewashek-dmi]

Yes, I can confirm that my sites are also no longer reporting as "unsafe". Hurray!!!

[iancoetzer]

excellent, thank you Microsoft 💪