Back to Checks
azure

Function app has Virtual Network integration enabled

app_function_vnet_integration_enabled
Service: appSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:microsoft.web/sites

Azure Function apps configured with Virtual Network integration uses a chosen subnet so outbound traffic is routed via the VNet and can reach private or service-endpoint-secured resources.

The finding reflects whether a function app is associated with a subnet resource ID.

Prowler logoProwlerprowler-provider-azure

Risk

Without VNet integration, function apps send egress directly to the public Internet and cannot reach private endpoints.

This weakens confidentiality and integrity by bypassing NSG/UDR controls, enables data exfiltration from compromised code, and may force exposing backends publicly, increasing attack surface.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_function_vnet_integration_enabled

Recommendation

Enable Virtual Network integration and attach function apps to a dedicated subnet to enforce least privilege network access.

Route egress through the VNet (e.g., Route All), apply NSGs/UDRs, and use private endpoints or service endpoints for dependencies. Restrict outbound traffic by default as part of defense in depth.

Remediation

CLI

az functionapp vnet-integration add --name <function_app_name> --resource-group <resource_group_name> --vnet <vnet_name> --subnet <subnet_name>

Terraform

# Enable VNet integration for an existing Function App
resource "azurerm_app_service_virtual_network_swift_connection" "<example_resource_name>" {
  app_service_id = "/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>/providers/Microsoft.Web/sites/<example_resource_name>" # CRITICAL: target Function App resource ID
  subnet_id      = "/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>/providers/Microsoft.Network/virtualNetworks/<example_resource_name>/subnets/<example_resource_name>" # CRITICAL: subnet to integrate with
}

NativeIaC

// Enable VNet integration for an existing Function App
resource vnetConn 'Microsoft.Web/sites/virtualNetworkConnections@2022-03-01' = {
  name: '<example_resource_name>/<example_resource_name>' // <function_app_name>/<vnet_name>
  properties: {
    subnetResourceId: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>/providers/Microsoft.Network/virtualNetworks/<example_resource_name>/subnets/<example_resource_name>' // CRITICAL: attaches the Function App to this subnet
    isSwift: true // CRITICAL: enables regional VNet (Swift) integration
  }
}

Other

1In the Azure portal, go to your Function App
2Select Networking > VNet Integration
3Click Add VNet
4Choose the target Virtual network and Subnet
5Click OK/Save to apply

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_function_vnet_integration_enabled(Check):
    def execute(self):
        findings = []

        for (
            subscription_id,
            functions,
        ) in app_client.functions.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for function in functions.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=function)
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) does not have virtual network integration enabled."

                if function.vnet_subnet_id:
                    report.status = "PASS"
                    report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) has Virtual Network integration enabled with subnet '{function.vnet_subnet_id}' enabled."

                findings.append(report)

        return findings

References