Function app managed identity has no admin-level roles

​

What this check verifies

Azure Function apps with managed identities are evaluated for assignments to broad administrative roles: Owner, Contributor, User Access Administrator, RBAC Administrator. The finding highlights functions whose identity carries elevated permissions beyond normal runtime needs.

​

Risk

Admin rights on a function’s identity expose the control plane.

• Confidentiality: read secrets and data
• Integrity: alter configs, grant roles, deploy changes
• Availability: stop or delete resources A runtime compromise can enable lateral movement and privilege escalation across the environment.

​

Recommendation

Apply least privilege: grant only narrowly scoped, data-plane permissions needed by the function; avoid broad roles like Owner or Contributor. Use separation of duties and just-in-time elevation for rare admin tasks. Regularly review role assignments and restrict scope to the smallest necessary boundary.

​

Remediation

​

References

• https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/Functions/azure-function-admin-permissions.html
• https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-identity-authorization#use-the-principle-of-least-privilege
• https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview

​

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_function_identity_without_admin_privileges. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Azure checks