Back to Checks
azure

Function app has a system-assigned or user-assigned managed identity enabled

app_function_identity_is_configured
Service: appSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.web/sites

Azure Function Apps are evaluated for an enabled managed identity (SystemAssigned or UserAssigned) configured on the app.

The finding indicates whether an identity is present to support token-based access to other Azure resources.

Prowler logoProwlerprowler-provider-azure

Risk

Without managed identities, apps rely on stored secrets/keys, risking:

  • Confidentiality loss from leaked credentials
  • Integrity tampering via unauthorized writes
  • Availability outages from secret expiry/rotation

Compromised keys enable unauthorized access and lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_function_identity_is_configured

Recommendation

Enable a managed identity on each Function App (SystemAssigned per app, UserAssigned for shared/long-lived needs). Replace secrets with token-based access and grant only required RBAC roles (least privilege). Remove keys from settings, apply separation of duties, and monitor access as part of defense in depth.

Remediation

CLI

az functionapp identity assign --resource-group <resource_group> --name <function_name>

Terraform

# Enable managed identity on an existing Function App via PATCH
resource "azapi_update_resource" "<example_resource_name>" {
  type       = "Microsoft.Web/sites@2022-03-01"
  resource_id = "<example_resource_id>"
  body = jsonencode({
    identity = {
      type = "SystemAssigned" # CRITICAL: Enables a system-assigned managed identity so the check passes
    }
  })
}

NativeIaC

// Enable managed identity on an existing Function App
param location string = resourceGroup().location

resource functionApp 'Microsoft.Web/sites@2022-03-01' = {
  name: '<example_resource_name>'
  location: location
  identity: {
    type: 'SystemAssigned' // CRITICAL: Enables a system-assigned managed identity so the check passes
  }
}

Other

1In Azure Portal, go to your Function App
2Under Settings, select Identity
3On the System assigned tab, set Status to On
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_function_identity_is_configured(Check):
    def execute(self):
        findings = []

        for (
            subscription_id,
            functions,
        ) in app_client.functions.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for function in functions.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=function)
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) does not have a managed identity enabled."

                if function.identity:
                    identity_type = (
                        function.identity.type
                        if getattr(function.identity, "type", "")
                        else "managed"
                    )
                    report.status = "PASS"
                    report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) has a {identity_type} identity enabled."

                findings.append(report)

        return findings

References