Function apps should have 'Client Certificates (Incoming client certificates)' enabled
Client certificates allow for the app to request a certificate for incoming requests. Only clients with valid certificates will be able to reach the app.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Function apps should have Client Certificates (Incoming client certificates) enabled" (3978e137-4c94-4056-824c-c03c2616faad); PowerPipe control azure_compliance.control.appservice_function_app_client_certificates_on.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CM-6 (Configuration Settings).
Framework mappings
The clauses this control is mapped to in each framework.
- Configuration Settings (CM-6)
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- 3.1.b Segregation of Functions
- 3.8 Digital Signatures
- CM-6 Configuration Settings
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_client_certificates_on - Powerpipe Control:
azure_compliance.control.appservice_function_app_client_certificates_on - Azure Policy Definition:
3978e137-4c94-4056-824c-c03c2616faad
Last reviewed: 2026-10-10