Check ID: app_function_latest_runtime_version
Provider: Azure
Service: app
Severity: MEDIUM
Categories: vulnerabilities
Resource type: microsoft.web/sites

What this check verifies

Azure Function apps are assessed for the runtime version set via FUNCTIONS_EXTENSION_VERSION. The finding identifies apps not configured to use the current supported major version ~4.

Risk

Outdated Functions runtimes erode CIA:
  • Confidentiality: known flaws enable unauthorized data access.
  • Integrity: RCE or binding bugs allow code tampering.
  • Availability: missing fixes cause crashes and scale faults.
End-of-support versions (e.g., 2.x/3.x) lack security patches, increasing exploitability.

Recommendation

Standardize on supported runtime ~4 and align language/extension versions.
  • Enforce upgrades in CI/CD and use staging to validate before rollout.
  • Apply least privilege for app identities and secrets.
  • Prefer automated patching and periodic reviews to avoid drift; avoid downgrades or indefinite minor pinning.

Remediation

az functionapp config appsettings set --name <function_app_name> --resource-group <resource_group_name> --settings FUNCTIONS_EXTENSION_VERSION=~4

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_function_latest_runtime_version. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks