Function App has Application Insights configured

Check ID: app_function_application_insights_enabled
Provider: Azure
Service: app
Severity: MEDIUM
Categories: logging
Resource type: microsoft.web/sites

What this check verifies

Azure Function apps are configured to send telemetry to Application Insights when application settings include APPLICATIONINSIGHTS_CONNECTION_STRING or APPINSIGHTS_INSTRUMENTATIONKEY.

Risk

Without this telemetry, visibility into exceptions, dependencies, and performance is lost, reducing availability and delaying response. Gaps in traces mask anomalous traffic and failures, enabling prolonged outages and undermining integrity of processing (e.g., undetected retries or timeouts).

Recommendation

Enable Application Insights for each Function App using a APPLICATIONINSIGHTS_CONNECTION_STRING and standardize telemetry. Apply defense in depth: use distributed tracing, alert on errors/latency, and enforce least-privilege access and retention on logs to prevent blind spots and speed recovery.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az functionapp config appsettings set --resource-group <RESOURCE_GROUP> --name <FUNCTION_APP_NAME> --settings APPLICATIONINSIGHTS_CONNECTION_STRING=<CONNECTION_STRING>

# Add Application Insights connection string to an existing Function App via ARM deployment
resource "azurerm_resource_group_template_deployment" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<RESOURCE_GROUP>"
  deployment_mode     = "Incremental"

  template_content = jsonencode({
    "$schema"      = "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion" = "1.0.0.0",
    "resources"    = [
      {
        "type"       = "Microsoft.Web/sites/config",
        "apiVersion" = "2022-09-01",
        "name"       = "<FUNCTION_APP_NAME>/appsettings",
        "properties" = {
          "APPLICATIONINSIGHTS_CONNECTION_STRING" = "<CONNECTION_STRING>" // Critical: setting this enables Application Insights for the Function App
        }
      }
    ]
  })
}

// Add Application Insights connection string to an existing Function App
resource functionApp 'Microsoft.Web/sites@2022-09-01' existing = {
  name: '<example_resource_name>'
}

resource appSettings 'Microsoft.Web/sites/config@2022-09-01' = {
  name: '${functionApp.name}/appsettings'
  properties: {
    APPLICATIONINSIGHTS_CONNECTION_STRING: '<CONNECTION_STRING>' // Critical: setting this enables Application Insights for the Function App
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_function_application_insights_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Function app has function keys configured Function app has FTP and FTPS deployments disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires