Function apps should have function keys configured
Azure Function apps are evaluated for configured function access keys on HTTP endpoints. The finding distinguishes functions with at least one access key defined from those without any keys configured.
Missing access keys weakens authentication, enabling unsolicited calls to function endpoints. This risks loss of confidentiality via data exposure, compromised integrity by triggering unintended actions, and reduced availability from abuse, throttling, and cost spikes.
What this control checks
Function apps should have function keys configured
Audit evidence
Evidence that deployed resources meet this control: Prowler check app_function_access_keys_configured (prowler azure --checks app_function_access_keys_configured).
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.8.3 (Information Access Restriction).
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;), 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...) and 3 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.3 Information access restriction
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- IAM-03.01AS The cloud service provider documents and implements a process to monitor stolen and compromised credentials and to disable any identity for which an issue is identified, pending a review by an authorised person. This process is implemented on all identities under the cloud service...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_app_function_access_keys_configured - Prowler Check:
app_function_access_keys_configured
Last reviewed: 2026-10-11