Regarding .NET Trust level set

Hi @Veeramani M ,

Thank you for providing the details.

I don't think your application is misconfigured. The issue is that a legacy requirement (e.g., “Set ASP.NET trust level to Medium”) remains in your documentation/policy even though the underlying mechanism is obsolete and non-functional on supported platforms. Enforcing it now adds confusion and inefficiency.

Microsoft’s documentation explicitly notes that Code Access Security (CAS) and legacy trust levels are deprecated: netFx40_legacySecurityPolicy element (Microsoft Docs)

Version applicability:

• .NET Framework 2.0–3.5: CAS policy (and thus partial trust like “Medium”) was always in effect.
• .NET Framework 4.x: CAS / partial trust is effectively off by default; you would have to explicitly (and inadvisably) re‑enable legacy CAS via <NetFx40_LegacySecurityPolicy>.
• .NET (Core) / .NET 5+ / 6+ / 7+ / 8+: CAS and ASP.NET trust levels are not implemented; related configuration is ignored or produces errors.

How to resolve (document-level remediation)

1. Mark the old control (e.g., “Set ASP.NET trust level to Medium”) as Deprecated.
2. Add a short rationale: CAS / trust levels are deprecated and not honored in supported .NET versions.
3. Remove or instruct teams to remove any leftover <trust> or <NetFx40_LegacySecurityPolicy> elements unless a genuine .NET 2.0/3.5 legacy application still exists.
4. Introduce a replacement control focused on real isolation and least privilege (process/service identity, filesystem ACLs, restricted network egress, container/VM isolation, proper secret management).
5. Define an exception process for any unavoidable legacy ≤3.5 applications, with a time‑bound migration plan.

Suggested wording

ASP.NET trust levels (e.g., “Medium”) and Code Access Security (CAS) are deprecated.

• .NET Framework 4.x applications run effectively in full trust unless legacy CAS is explicitly re‑enabled (not permitted).
• Modern .NET (Core / 5+) does not implement CAS or partial trust.
  This legacy requirement is retired. Security boundaries must be enforced through:
• Least‑privileged application pool or service identities
• Restricted filesystem write locations (logs / temp / uploads only)
• Controlled outbound network access (allow‑list / firewall)
• Container or VM isolation and proper secrets management
  Any remaining .NET 2.0/3.5 applications relying on partial trust require a documented, time‑bound exception and migration plan.

Optional deprecation note

Deprecated: “Set ASP.NET trust level to Medium.” CAS / trust levels no longer provide an enforceable sandbox in supported .NET versions. Do not introduce <trust> elements into new or maintained applications.

In summary, no runtime fix is needed. Modernize the document: deprecate the outdated CAS/trust-level control and replace it with concrete least‑privilege and environment isolation requirements.

I hope this is helpful. Please reach out if you still need any help.