Function apps should not allow CORS access from every resource
Checks the CORS settings of Azure Function apps to confirm they do not allow cross-origin access from every resource. Function apps that list only specific origins pass the check, while apps that are open to all origins do not pass.
Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app.
What this control checks
Function apps must not allow CORS requests from every origin (wildcard access)
Common pitfalls
Default effect is AuditIfNotExists
The effect parameter has a default value of AuditIfNotExists. The allowed values are AuditIfNotExists and Disabled.
Workflow and container apps are excluded
The policy rule requires kind to contain functionapp. It requires kind to not contain workflowapp and to not contain azurecontainerapps.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Function apps should not have CORS configured to allow every resource to access your apps" (0820b7b9-23aa-4725-a1ce-ae4558f718e5); PowerPipe control azure_compliance.control.appservice_function_app_cors_no_star.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CM-6 (Configuration Settings).
FedRAMP Moderate Baseline Rev 4: Mapped to CM-6 (Configuration Settings).
Framework mappings
The clauses this control is mapped to in each framework.
- Configuration Settings (CM-6)
FedRAMP Moderate Baseline Rev 4
- CM-6 Configuration Settings
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- CM-6 Configuration Settings
- 0902.09s2Organizational.13-09.s 09.08 Exchange of Information
- 0960.09sCSPOrganizational.1-09.s 09.08 Exchange of Information
Related controls
- App Service function apps should have public access restrictions configured
- App Service apps should have Client Certificates (Incoming client certificates) enabled
- App Service web apps should require HTTPS for all access
- Function apps should have function keys configured
- App Service web apps should require FTPS
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_cors_no_star - Powerpipe Control:
azure_compliance.control.appservice_function_app_cors_no_star - Azure Policy Definition:
0820b7b9-23aa-4725-a1ce-ae4558f718e5
Last reviewed: 2026-10-10