Azure Compliance ControlsAzure Functions
Function apps should have remote debugging disabled
Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off. The mapped checks look at the remote debugging setting on function apps.
What this control checks
Function apps should have remote debugging disabled.
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Configuration Settings (CM-6)
FedRAMP Moderate Baseline Rev 4
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- CM-6 Configuration Settings
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.1.12: Monitor and control remote access sessions.
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- 3.1.b Segregation of Functions
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- AC.L2-3.1.12 Monitor and control remote access sessions
- CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- CM-6 Configuration Settings
- 0913.09s1Organizational.5-09.s 09.08 Exchange of Information
- 1195.01l3Organizational.1-01.l 01.04 Network Access Control
- 1325.09s1Organizational.3-09.s 09.08 Exchange of Information
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_remote_debugging_disabled - Checkov Check:
CKV_AZURE_72 - Powerpipe Control:
azure_compliance.control.appservice_function_app_remote_debugging_disabled - Azure Policy Definitions:
0e60b895-3786-45da-8377-9c6b4b6ac5f9,25a5046c-c423-4805-9235-e844ae9ef49b
Last reviewed: 2026-10-11