Function app has Virtual Network integration enabled

Check ID: app_function_vnet_integration_enabled
Provider: Azure
Service: app
Severity: MEDIUM
Categories: trust-boundaries
Resource type: microsoft.web/sites

What this check verifies

Azure Function apps configured with Virtual Network integration uses a chosen subnet so outbound traffic is routed via the VNet and can reach private or service-endpoint-secured resources. The finding reflects whether a function app is associated with a subnet resource ID.

Risk

Without VNet integration, function apps send egress directly to the public Internet and cannot reach private endpoints. This weakens confidentiality and integrity by bypassing NSG/UDR controls, enables data exfiltration from compromised code, and may force exposing backends publicly, increasing attack surface.

Recommendation

Enable Virtual Network integration and attach function apps to a dedicated subnet to enforce least privilege network access. Route egress through the VNet (e.g., Route All), apply NSGs/UDRs, and use private endpoints or service endpoints for dependencies. Restrict outbound traffic by default as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az functionapp vnet-integration add —name <function_app_name> —resource-group <resource_group_name> —vnet <vnet_name> —subnet <subnet_name>

# Enable VNet integration for an existing Function App
resource "azurerm_app_service_virtual_network_swift_connection" "<example_resource_name>" {
  app_service_id = "/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>/providers/Microsoft.Web/sites/<example_resource_name>" # CRITICAL: target Function App resource ID
  subnet_id      = "/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>/providers/Microsoft.Network/virtualNetworks/<example_resource_name>/subnets/<example_resource_name>" # CRITICAL: subnet to integrate with
}

// Enable VNet integration for an existing Function App
resource vnetConn 'Microsoft.Web/sites/virtualNetworkConnections@2022-03-01' = {
  name: '<example_resource_name>/<example_resource_name>' // <function_app_name>/<vnet_name>
  properties: {
    subnetResourceId: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>/providers/Microsoft.Network/virtualNetworks/<example_resource_name>/subnets/<example_resource_name>' // CRITICAL: attaches the Function App to this subnet
    isSwift: true // CRITICAL: enables regional VNet (Swift) integration
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_function_vnet_integration_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Function app is not publicly accessible App Service web app has HTTP logs enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires