Function apps should use managed identity
Function apps should use managed identity. The Azure Policy audits Microsoft.Web/sites function apps for a managed identity. Prowler checks for a SystemAssigned or UserAssigned managed identity on the app. KICS flags a Function App with managed identity disabled.
Without managed identities, apps rely on stored secrets/keys, risking: Confidentiality loss from leaked credentials. Integrity tampering via unauthorized writes. Availability outages from secret expiry/rotation.
What this control checks
Checks whether Function apps use a managed identity
Common pitfalls
Policy effect defaults to AuditIfNotExists
The policy effect defaults to AuditIfNotExists. The allowed values are AuditIfNotExists and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Function apps should use managed identity" (0da106f2-4ca3-48e8-bc85-c638fe6aea8f); Prowler check app_function_identity_is_configured (prowler azure --checks app_function_identity_is_configured); PowerPipe control azure_compliance.control.appservice_function_app_uses_managed_identity.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Function App Managed Identity Disabled" (c87749b3-ff10-41f5-9df2-c421e8151759).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 7.2.1 (Access to system components and data is appropriately defined and assigned.), 7.2.2 (Access to system components and data is appropriately defined and assigned.), 7.2.5 (Access to system components and data is appropriately defined and assigned.) and 4 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 11.5.2.a (set up unique identities for network and information systems and their users;), 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;), 2.1.2.i (identify who is responsible for implementing the risk treatment measures and when they should be implemented;) and 5 more clauses.
NIST SP 800-53 Rev 5: Mapped to AC-2 (Account Management), AC-3 (Access Enforcement), IA-2 (Identification and Authentication (organizational Users)) and 1 more clause.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-2 (Account Management), AC-3 (Access Enforcement), IA-2 (Identification and Authentication (Organizational users)) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
2 more clauses
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.3.4: Strong authentication for users and administrators is established and managed.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- AC-2 Account Management
- Access Enforcement (AC-3)
- IA-2: Identification And Authentication
- IA-4 Identifier Management
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
- IA-4 Identifier Management
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.5.1 Identify system users, processes acting on behalf of users, and devices
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- 3.5.6 Disable identifiers after a defined period of inactivity
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
- AC-2 Account Management
- AC-3 Access Enforcement
- IA-2 Identification and Authentication (Organizational users)
- IA-4 Identifier Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_uses_managed_identity - Powerpipe Control:
azure_compliance.control.appservice_function_app_uses_managed_identity - Prowler Check:
app_function_identity_is_configured - Azure Policy Definition:
0da106f2-4ca3-48e8-bc85-c638fe6aea8f - KICS Query:
c87749b3-ff10-41f5-9df2-c421e8151759
Last reviewed: 2026-10-11