Azure Compliance ControlsAzure Functions
App Service function apps should have public access restrictions configured
Checks the `publicNetworkAccess` state of an App Service function app and the access restrictions or private endpoints that limit inbound traffic to it. The evaluation covers both the public network access setting and the inbound traffic limits.
What this control checks
Function app is not publicly accessible; publicNetworkAccess should be Disabled
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
5 more clauses
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- 164.308(a)(3)(i) Workforce security
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_restrict_public_acces - Powerpipe Control:
azure_compliance.control.appservice_function_app_restrict_public_acces - Prowler Check:
app_function_not_publicly_accessible
Last reviewed: 2026-10-11