Azure Compliance ControlsAzure Functions
Function apps should not allow CORS access from every resource
Checks the CORS settings of Azure Function apps to confirm they do not allow cross-origin access from every resource. Function apps that list only specific origins pass the check, while apps that are open to all origins do not pass.
What this control checks
Function apps must not allow CORS requests from every origin (wildcard access)
Framework mappings
The clauses this control is mapped to in each framework.
- Configuration Settings (CM-6)
FedRAMP Moderate Baseline Rev 4
- CM-6 Configuration Settings
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- CM-6 Configuration Settings
- 0902.09s2Organizational.13-09.s 09.08 Exchange of Information
- 0960.09sCSPOrganizational.1-09.s 09.08 Exchange of Information
Related controls
- App Service function apps should have public access restrictions configured
- App Service apps should have Client Certificates (Incoming client certificates) enabled
- App Service web apps should require HTTPS for all access
- Function apps should have function keys configured
- App Service web apps should require FTPS
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_cors_no_star - Powerpipe Control:
azure_compliance.control.appservice_function_app_cors_no_star - Azure Policy Definition:
0820b7b9-23aa-4725-a1ce-ae4558f718e5
Last reviewed: 2026-10-10