Function apps should have virtual network integration enabled
Azure Function apps configured with Virtual Network integration use a chosen subnet so outbound traffic is routed via the VNet and can reach private or service-endpoint-secured resources.
Without VNet integration, function apps send egress directly to the public Internet and cannot reach private endpoints. This weakens confidentiality and integrity by bypassing NSG/UDR controls, enables data exfiltration from compromised code, and may force exposing backends publicly, increasing attack surface.
What this control checks
Function apps should have virtual network integration enabled
Audit evidence
Evidence that deployed resources meet this control: Prowler check app_function_vnet_integration_enabled (prowler azure --checks app_function_vnet_integration_enabled).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.3.1 (Network access to and from the cardholder data environment is restricted.), 1.3.2 (Network access to and from the cardholder data environment is restricted.) and 3 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;), 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
1 more clause
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_app_function_vnet_integration_enabled - Prowler Check:
app_function_vnet_integration_enabled
Last reviewed: 2026-10-11