Function app managed identities should not have Owner, Contributor, User Access Administrator, or RBAC Administrator roles
Azure Function apps with managed identities are evaluated for assignments to broad administrative roles: Owner, Contributor, User Access Administrator, RBAC Administrator.
Admin rights on a function's identity expose the control plane. A runtime compromise can enable lateral movement and privilege escalation across the environment.
What this control checks
Function app managed identities should not hold administrative privileged roles
Audit evidence
Evidence that deployed resources meet this control: Prowler check app_function_identity_without_admin_privileges (prowler azure --checks app_function_identity_without_admin_privileges).
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;), 2.1.2.i (identify who is responsible for implementing the risk treatment measures and when they should be implemented;), 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;) and 4 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_app_function_identity_without_admin_privileges - Prowler Check:
app_function_identity_without_admin_privileges
Last reviewed: 2026-10-11