Back to Checks
azure

Function app is not publicly accessible

app_function_not_publicly_accessible
Service: appSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:microsoft.web/sites

Azure Function apps are assessed for whether they are reachable from the public Internet. The evaluation considers the app's publicNetworkAccess state and the presence of access restrictions or private endpoints to limit inbound traffic.

Prowler logoProwlerprowler-provider-azure

Risk

Public exposure allows unauthorized invocation, risking data disclosure and tampering (confidentiality and integrity). Attackers can brute-force tokens or abuse misconfigurations for remote execution. Unrestricted calls also enable abuse and DoS, driving cost and harming availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_function_not_publicly_accessible

Recommendation

Apply network isolation and least privilege:

  • Set publicNetworkAccess=Disabled
  • Use access restrictions for trusted IPs/VNets or Private Endpoints
  • Require strong auth (e.g., Microsoft Entra ID) over shared keys
  • Front with API Management/WAF
  • Keep secrets in Key Vault and monitor access logs

Remediation

CLI

az functionapp update --resource-group <RESOURCE_GROUP> --name <FUNCTION_APP_NAME> --set publicNetworkAccess=Disabled

Terraform

# Disable public network access for the Function App
resource "azurerm_linux_function_app" "<example_resource_name>" {
  name                       = "<example_resource_name>"
  location                   = azurerm_resource_group.main.location
  resource_group_name        = azurerm_resource_group.main.name
  service_plan_id            = azurerm_service_plan.main.id
  storage_account_name       = azurerm_storage_account.main.name
  storage_account_access_key = azurerm_storage_account.main.primary_access_key

  public_network_access_enabled = false # Critical: disables public endpoint access
}

NativeIaC

// Disable public access by denying all unmatched traffic
resource functionApp 'Microsoft.Web/sites@2022-09-01' existing = {
  name: '<example_resource_name>'
}

resource siteConfig 'Microsoft.Web/sites/config@2022-09-01' = {
  name: '${functionApp.name}/web'
  properties: {
    ipSecurityRestrictionsDefaultAction: 'Deny' // Critical: blocks public access via default endpoint
  }
}

Other

1In the Azure portal, go to your Function App
2Select Networking
3Under Public access, set Public network access to Disabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_function_not_publicly_accessible(Check):
    def execute(self):
        findings = []

        for (
            subscription_id,
            functions,
        ) in app_client.functions.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for function in functions.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=function)
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is publicly accessible."

                if not function.public_access:
                    report.status = "PASS"
                    report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is not publicly accessible."

                findings.append(report)

        return findings

References