Back to Checks
azure

Function app has function keys configured

app_function_access_keys_configured
Service: appSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesssecrets
Resource Type:microsoft.web/sites

Azure Function apps are evaluated for configured function access keys on HTTP endpoints.

The finding distinguishes functions with at least one access key defined from those without any keys configured.

Prowler logoProwlerprowler-provider-azure

Risk

Missing access keys weakens authentication, enabling unsolicited calls to function endpoints. This risks:

  • loss of confidentiality via data exposure
  • compromised integrity by triggering unintended actions
  • reduced availability from abuse, throttling, and cost spikes

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_function_access_keys_configured

Recommendation

Enforce function keys for non-public endpoints and apply least privilege:

  • avoid anonymous when not required
  • rotate keys; don't share the admin key
  • enable App Service Authentication or API Management for identity-aware access
  • restrict inbound networks and monitor logs
  • store and rotate secrets in Key Vault

Remediation

CLI

az functionapp function keys set --resource-group <RESOURCE_GROUP> --name <FUNCTION_APP_NAME> --function-name <FUNCTION_NAME> --key-name default --key-value <KEY_VALUE>

Other

1Sign in to the Azure portal and go to your Function App
2Select Functions, then click the specific function
3Open Function keys (or API keys)
4Click Add (New function key), set Name (e.g., default) and value (or generate)
5Save to create the key

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_function_access_keys_configured(Check):
    def execute(self):
        findings = []

        for (
            subscription_id,
            functions,
        ) in app_client.functions.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for function in functions.values():
                if function.function_keys is not None:
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=function
                    )
                    report.subscription = subscription_id
                    report.status = "FAIL"
                    report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) does not have function keys configured."

                    if len(function.function_keys) > 0:
                        report.status = "PASS"
                        report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) has function keys configured."

                    findings.append(report)

        return findings

References