Microsoft AzureOverview
Remote debugging opens additional management access paths to the Function App runtime and should only be enabled temporarily during active troubleshooting. Leaving it enabled in production increases the blast radius of compromised developer credentials or exposed management endpoints.
Disable remote debugging except for short, approved maintenance windows.
Remediation guidance
Remediation
Disable remote debugging on the Function App.
Azure CLI
az resource update \
--ids {{asset.idFromProvider}}/config/web \
--set properties.remoteDebuggingEnabled=false
Validate the setting:
az resource show \
--ids {{asset.idFromProvider}}/config/web \
--query 'properties.remoteDebuggingEnabled'
References
- https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts
- https://learn.microsoft.com/en-us/azure/app-service/configure-common
Query logic
These are the stored checks tied to this control.
Azure Function Apps with remote debugging enabled
Connectors
Microsoft Azure
Covered asset types
FunctionApp
Expected check: eq []
{
functionApps(
where: {
configs_SOME: {
remoteDebuggingEnabled: { eq: true }
}
}
) {
...AssetFragment
}
}
