Back to Checks
azure

Function App has Application Insights configured

app_function_application_insights_enabled
Service: appSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.web/sites

Azure Function apps are configured to send telemetry to Application Insights when application settings include APPLICATIONINSIGHTS_CONNECTION_STRING or APPINSIGHTS_INSTRUMENTATIONKEY.

Prowler logoProwlerprowler-provider-azure

Risk

Without this telemetry, visibility into exceptions, dependencies, and performance is lost, reducing availability and delaying response. Gaps in traces mask anomalous traffic and failures, enabling prolonged outages and undermining integrity of processing (e.g., undetected retries or timeouts).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_function_application_insights_enabled

Recommendation

Enable Application Insights for each Function App using a APPLICATIONINSIGHTS_CONNECTION_STRING and standardize telemetry. Apply defense in depth: use distributed tracing, alert on errors/latency, and enforce least-privilege access and retention on logs to prevent blind spots and speed recovery.

Remediation

CLI

az functionapp config appsettings set --resource-group <RESOURCE_GROUP> --name <FUNCTION_APP_NAME> --settings APPLICATIONINSIGHTS_CONNECTION_STRING=<CONNECTION_STRING>

Terraform

# Add Application Insights connection string to an existing Function App via ARM deployment
resource "azurerm_resource_group_template_deployment" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<RESOURCE_GROUP>"
  deployment_mode     = "Incremental"

  template_content = jsonencode({
    "$schema"      = "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion" = "1.0.0.0",
    "resources"    = [
      {
        "type"       = "Microsoft.Web/sites/config",
        "apiVersion" = "2022-09-01",
        "name"       = "<FUNCTION_APP_NAME>/appsettings",
        "properties" = {
          "APPLICATIONINSIGHTS_CONNECTION_STRING" = "<CONNECTION_STRING>" // Critical: setting this enables Application Insights for the Function App
        }
      }
    ]
  })
}

NativeIaC

// Add Application Insights connection string to an existing Function App
resource functionApp 'Microsoft.Web/sites@2022-09-01' existing = {
  name: '<example_resource_name>'
}

resource appSettings 'Microsoft.Web/sites/config@2022-09-01' = {
  name: '${functionApp.name}/appsettings'
  properties: {
    APPLICATIONINSIGHTS_CONNECTION_STRING: '<CONNECTION_STRING>' // Critical: setting this enables Application Insights for the Function App
  }
}

Other

1In Azure Portal, go to Function App > Configuration > Application settings
2Click + New application setting
3Name: APPLICATIONINSIGHTS_CONNECTION_STRING
4Value: paste the connection string from your Application Insights resource (Overview > Connection string)
5Click OK, then Save
6If prompted, click Continue to apply the changes

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_function_application_insights_enabled(Check):
    def execute(self):
        findings = []

        for (
            subscription_id,
            functions,
        ) in app_client.functions.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for function in functions.values():
                if function.environment_variables is not None:
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=function
                    )
                    report.subscription = subscription_id
                    report.status = "FAIL"
                    report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is not using Application Insights."

                    if function.environment_variables.get(
                        "APPINSIGHTS_INSTRUMENTATIONKEY", None
                    ) or function.environment_variables.get(
                        "APPLICATIONINSIGHTS_CONNECTION_STRING", None
                    ):
                        report.status = "PASS"
                        report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is using Application Insights."

                    findings.append(report)

        return findings

References