Function apps should have App Service authentication configured
Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the Function app, or authenticate those that have tokens before they reach the Function app. Function apps should have authentication enabled.
Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the Function app, or authenticate those that have tokens before they reach the Function app.
What this control checks
Function apps must have App Service authentication enabled (siteAuthEnabled equals true).
Common pitfalls
Only AuditIfNotExists and Disabled are allowed effects
The policy's default effect is AuditIfNotExists, and the allowed values are AuditIfNotExists and Disabled.
Rule matches only apps whose kind contains functionapp
The policy rule requires kind to contain functionapp. It also requires kind to not contain workflowapp and to not contain azurecontainerapps.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Function apps should have authentication enabled" (c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8); PowerPipe control azure_compliance.control.appservice_function_app_authentication_on.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_authentication_on - Powerpipe Control:
azure_compliance.control.appservice_function_app_authentication_on - Azure Policy Definition:
c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8
Last reviewed: 2026-10-10