Ensure that administrative endpoints are disabled for your Microsoft Azure Function Apps in order to enhance security by preventing unauthorized access to sensitive management operations, reducing the risk of attacks like privilege escalation or data breaches. Administrative endpoints can be disabled by setting the functionsRuntimeAdminIsolationEnabled application setting to true.
Application settings in an Azure Function App provide configuration options that impact all functions within the app and are accessed as environment variables. An important application setting is functionsRuntimeAdminIsolationEnabled, which controls access to the built-in administrator (i.e. /admin) endpoints. By default, this is set to false, allowing requests to the /admin endpoints if a master key is provided. When set to true, access to these endpoints is blocked, even with a master key. Function apps expose /admin endpoints for tasks like retrieving host status and performing test invocations, which require the app's master key for access. For optimal security and compliance with regulatory requirements, it is strongly recommended to disable administrative endpoints on your Microsoft Azure Function Apps.
Audit
To determine if administrative endpoints are disabled for your Microsoft Azure Function Apps, perform the following operations:
Remediation / Resolution
To disable administrative endpoints for your Microsoft Azure Function Apps, perform the following operations:
1. functionsRuntimeAdminIsolationEnabled can be set for apps running on the Linux Consumption SKU and it cannot be set for apps running on version 1.x of Azure Function Apps. If you are using version 1.x, you must first migrate to version 4.x.2. Your Azure Function App may restart if you are updating application settings or connection strings.
References
- Azure Official Documentation
- Best practices for reliable Azure Functions
- App settings reference for Azure Functions
- Disable administrative endpoints
- Azure PowerShell Documentation
- az account list
- az account set
- az functionapp list
- az functionapp config appsettings list
- az functionapp config appsettings set
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Disable Administrative Endpoints
Risk Level: Medium