Microsoft AzureOverview
Managed identities let Azure Function Apps access Azure resources without storing client secrets, passwords, or long-lived credentials in app settings. A function without managed identity is more likely to rely on static credentials, which increases the impact of configuration disclosure, log leakage, and source-code exposure.
Use a system-assigned identity for one-to-one lifecycle binding with the Function App, or a user-assigned identity when the same workload identity must be shared deliberately across apps.
Remediation guidance
Remediation
Enable a managed identity for the Function App and migrate dependent Azure resource access away from static credentials. Grant only the minimum roles required by the function.
Azure CLI
Enable a system-assigned managed identity:
az functionapp identity assign \
--resource-group {{asset.azureResourceGroup}} \
--name {{asset.name}}
Capture the assigned principal ID for role assignment planning:
az functionapp identity show \
--resource-group {{asset.azureResourceGroup}} \
--name {{asset.name}} \
--query principalId \
--output tsv
Grant least-privilege access to the required resource scope. Replace {{manual.roleName}} and {{manual.scope}} with the approved role and resource scope.
az role assignment create \
--assignee-object-id {{manual.principalId}} \
--assignee-principal-type ServicePrincipal \
--role "{{manual.roleName}}" \
--scope "{{manual.scope}}"
Rollout guidance
- Inventory app settings and Key Vault references used by the function.
- Replace secrets with managed identity authentication in SDKs or service clients.
- Remove obsolete secrets after successful deployment and monitor for authentication failures.
- Prefer narrow data-plane roles over broad subscription-level roles.
References
- https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity
- https://learn.microsoft.com/en-us/cli/azure/functionapp/identity
Query logic
These are the stored checks tied to this control.
Azure Function Apps without managed identity
Connectors
Covered asset types
Expected check: eq []
{
functionApps(where: { managedIdentities_NONE: {} }) {
...AssetFragment
}
}
