Azure Compliance ControlsAzure Functions
Function app managed identities should not have Owner, Contributor, User Access Administrator, or RBAC Administrator roles
Azure Function apps with managed identities are evaluated for assignments to broad administrative roles: Owner, Contributor, User Access Administrator, RBAC Administrator. The finding highlights functions whose identity carries elevated permissions beyond normal runtime needs.
What this control checks
Function app managed identities should not hold administrative privileged roles
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_app_function_identity_without_admin_privileges - Prowler Check:
app_function_identity_without_admin_privileges
Last reviewed: 2026-10-11