Function apps should have remote debugging disabled
Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off. The mapped checks look at the remote debugging setting on function apps.
Remote debugging requires inbound ports to be opened on Function apps.
What this control checks
Function apps should have remote debugging disabled.
Common pitfalls
Missing block passes the Checkov check
Checkov CKV_AZURE_72 inspects site_config/[0]/remote_debugging_enabled and expects False. The check is built with missing_block_result=CheckResult.PASSED.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Function apps should have remote debugging turned off" (0e60b895-3786-45da-8377-9c6b4b6ac5f9) and "Configure Function apps to turn off remote debugging" (25a5046c-c423-4805-9235-e844ae9ef49b); PowerPipe control azure_compliance.control.appservice_function_app_remote_debugging_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_72.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control) and CM-6 (Configuration Settings).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control) and CM-6 (Configuration Settings).
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Configuration Settings (CM-6)
FedRAMP Moderate Baseline Rev 4
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- CM-6 Configuration Settings
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.1.12: Monitor and control remote access sessions.
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- 3.1.b Segregation of Functions
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- AC.L2-3.1.12 Monitor and control remote access sessions
- CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- CM-6 Configuration Settings
- 0913.09s1Organizational.5-09.s 09.08 Exchange of Information
- 1195.01l3Organizational.1-01.l 01.04 Network Access Control
- 1325.09s1Organizational.3-09.s 09.08 Exchange of Information
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_remote_debugging_disabled - Checkov Check:
CKV_AZURE_72 - Powerpipe Control:
azure_compliance.control.appservice_function_app_remote_debugging_disabled - Azure Policy Definitions:
0e60b895-3786-45da-8377-9c6b4b6ac5f9,25a5046c-c423-4805-9235-e844ae9ef49b
Last reviewed: 2026-10-11