Function apps should use the latest supported runtime version (~4)
Azure Function apps are assessed for the runtime version set through the `FUNCTIONS_EXTENSION_VERSION` application setting. The finding identifies apps that are not configured to use the current supported major version, `~4`.
Outdated Functions runtimes erode CIA. End-of-support versions (e.g., 2.x/3.x) lack security patches, increasing exploitability.
What this control checks
Function apps must set FUNCTIONS_EXTENSION_VERSION to the supported major version ~4.
Common pitfalls
Use automated patching and periodic reviews to avoid drift
Prefer automated patching and periodic reviews to avoid drift.
Audit evidence
Evidence that deployed resources meet this control: Prowler check app_function_latest_runtime_version (prowler azure --checks app_function_latest_runtime_version).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 6.3.3 (Security vulnerabilities are identified and addressed.).
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;), 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 6.3.3: All system components are protected from known vulnerabilities by installing applicable security patches/updates
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- DEV-02.01B In the case of outsourced development of the cloud service (or individual system components), specifications regarding the following aspects are contractually agreed between the cloud service provider and the outsourced development contractor: - Security in software development...
- OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
- OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.
- OPS-27.01B The cloud service provider documents, communicates, and maintains processes and procedures to manage updates to system components used to provide the cloud service that incorporate third party or open-source libraries. This includes: - Regularly identifying available updates and known...
- OPS-33.02B Patch management procedures are harmonised with the cloud service provider's overall software change management process.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_app_function_latest_runtime_version - Prowler Check:
app_function_latest_runtime_version
Last reviewed: 2026-10-11