Function app has function keys configured

​

What this check verifies

Azure Function apps are evaluated for configured function access keys on HTTP endpoints. The finding distinguishes functions with at least one access key defined from those without any keys configured.

​

Risk

Missing access keys weakens authentication, enabling unsolicited calls to function endpoints. This risks:

• loss of confidentiality via data exposure
• compromised integrity by triggering unintended actions
• reduced availability from abuse, throttling, and cost spikes

​

Recommendation

Enforce function keys for non-public endpoints and apply least privilege:

• avoid anonymous when not required
• rotate keys; don’t share the admin key
• enable App Service Authentication or API Management for identity-aware access
• restrict inbound networks and monitor logs
• store and rotate secrets in Key Vault

​

Remediation

​

References

• https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts?tabs=v4#function-access-keys
• https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-http-webhook-trigger
• https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/Functions/azure-function-anonymous-access.html

​

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_function_access_keys_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Azure checks