App Service function apps should have public access restrictions configured
Checks the `publicNetworkAccess` state of an App Service function app and the access restrictions or private endpoints that limit inbound traffic to it. The evaluation covers both the public network access setting and the inbound traffic limits.
Public exposure allows unauthorized invocation, risking data disclosure and tampering (confidentiality and integrity). Attackers can brute-force tokens or abuse misconfigurations for remote execution. Unrestricted calls also enable abuse and DoS, driving cost and harming availability.
What this control checks
Function app is not publicly accessible; publicNetworkAccess should be Disabled
Audit evidence
Evidence that deployed resources meet this control: Prowler check app_function_not_publicly_accessible (prowler azure --checks app_function_not_publicly_accessible); PowerPipe control azure_compliance.control.appservice_function_app_restrict_public_acces.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...).
PCI DSS v4.0: Mapped to 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.3.1 (Network access to and from the cardholder data environment is restricted.), 1.3.2 (Network access to and from the cardholder data environment is restricted.) and 7 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;), 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
5 more clauses
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- 164.308(a)(3)(i) Workforce security
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_restrict_public_acces - Powerpipe Control:
azure_compliance.control.appservice_function_app_restrict_public_acces - Prowler Check:
app_function_not_publicly_accessible
Last reviewed: 2026-10-11