Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
app_function_latest_runtime_versionProvider: Azure
Service:
appSeverity: MEDIUM
Categories:
vulnerabilitiesResource type:
microsoft.web/sitesWhat this check verifies
Azure Function apps are assessed for the runtime version set viaFUNCTIONS_EXTENSION_VERSION. The finding identifies apps not configured to use the current supported major version ~4.
Risk
Outdated Functions runtimes erode CIA:- Confidentiality: known flaws enable unauthorized data access.
- Integrity: RCE or binding bugs allow code tampering.
- Availability: missing fixes cause crashes and scale faults.
Recommendation
Standardize on supported runtime~4 and align language/extension versions.
- Enforce upgrades in CI/CD and use staging to validate before rollout.
- Apply least privilege for app identities and secrets.
- Prefer automated patching and periodic reviews to avoid drift; avoid downgrades or indefinite minor pinning.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://docs.microsoft.com/en-us/azure/azure-functions/functions-versions
- https://learn.microsoft.com/en-us/azure/azure-functions/migrate-version-3-version-4?tabs=net8%2Cazure-cli%2Cwindows&pivots=programming-language-python
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/Functions/azure-function-runtime-version.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = app_function_latest_runtime_version. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks