Disable anonymous access for good

I have a simple question: In App Services, what would cause anonymous access to become reenabled? I use email/password authentication in my app and quite regularly I have to go back and disable anonymous access. I’m not sure if it’s something I’m doing or if it’s some kind of bug in Atlas but I do know that I never enable it. It just magically gets enabled randomly.