Azure Compliance ControlsAzure Functions
Function apps should have function keys configured
Azure Function apps are evaluated for configured function access keys on HTTP endpoints. The finding distinguishes functions with at least one access key defined from those without any keys configured.
What this control checks
Function apps should have function keys configured
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.3 Information access restriction
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- IAM-03.01AS The cloud service provider documents and implements a process to monitor stolen and compromised credentials and to disable any identity for which an issue is identified, pending a review by an authorised person. This process is implemented on all identities under the cloud service...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_app_function_access_keys_configured - Prowler Check:
app_function_access_keys_configured
Last reviewed: 2026-10-11