Azure Compliance ControlsAzure Functions
Function apps should use managed identity
Function apps should use managed identity. The Azure Policy audits Microsoft.Web/sites function apps for a managed identity. Prowler checks for a SystemAssigned or UserAssigned managed identity on the app. KICS flags a Function App with managed identity disabled.
What this control checks
Checks whether Function apps use a managed identity
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
2 more clauses
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.3.4: Strong authentication for users and administrators is established and managed.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- AC-2 Account Management
- Access Enforcement (AC-3)
- IA-2: Identification And Authentication
- IA-4 Identifier Management
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
- IA-4 Identifier Management
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.5.1 Identify system users, processes acting on behalf of users, and devices
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- 3.5.6 Disable identifiers after a defined period of inactivity
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
- AC-2 Account Management
- AC-3 Access Enforcement
- IA-2 Identification and Authentication (Organizational users)
- IA-4 Identifier Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_uses_managed_identity - Powerpipe Control:
azure_compliance.control.appservice_function_app_uses_managed_identity - Prowler Check:
app_function_identity_is_configured - Azure Policy Definition:
0da106f2-4ca3-48e8-bc85-c638fe6aea8f - KICS Query:
c87749b3-ff10-41f5-9df2-c421e8151759
Last reviewed: 2026-10-11