Function app has a managed identity enabled

Check ID: app_function_identity_is_configured
Provider: Azure
Service: app
Severity: MEDIUM
Categories: identity-access
Resource type: microsoft.web/sites

What this check verifies

Azure Function Apps are evaluated for an enabled managed identity (SystemAssigned or UserAssigned) configured on the app. The finding indicates whether an identity is present to support token-based access to other Azure resources.

Risk

Without managed identities, apps rely on stored secrets/keys, risking:

Confidentiality loss from leaked credentials
Integrity tampering via unauthorized writes
Availability outages from secret expiry/rotation

Compromised keys enable unauthorized access and lateral movement.

Recommendation

Enable a managed identity on each Function App (SystemAssigned per app, UserAssigned for shared/long-lived needs). Replace secrets with token-based access and grant only required RBAC roles (least privilege). Remove keys from settings, apply separation of duties, and monitor access as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az functionapp identity assign —resource-group <resource_group> —name <function_name>

# Enable managed identity on an existing Function App via PATCH
resource "azapi_update_resource" "<example_resource_name>" {
  type       = "Microsoft.Web/sites@2022-03-01"
  resource_id = "<example_resource_id>"
  body = jsonencode({
    identity = {
      type = "SystemAssigned" # CRITICAL: Enables a system-assigned managed identity so the check passes
    }
  })
}

// Enable managed identity on an existing Function App
param location string = resourceGroup().location

resource functionApp 'Microsoft.Web/sites@2022-03-01' = {
  name: '<example_resource_name>'
  location: location
  identity: {
    type: 'SystemAssigned' // CRITICAL: Enables a system-assigned managed identity so the check passes
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_function_identity_is_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Function app has FTP and FTPS deployments disabled Function app managed identity has no admin-level roles

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires