{
"cloud_resource": {
"account": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"category": "serverless",
"cloud_provider": "azure",
"configuration": {
"availability_state": "Normal",
"azure_app_service_plan_key": "abc123def456789012345678901234ab",
"azure_function_key": "def456abc789012345678901234567cd",
"client_affinity_enabled": false,
"client_cert_enabled": false,
"client_cert_mode": "Required",
"container_size": 1536,
"custom_domain_verification_id": "ABC123DEF456789012345678901234567890ABCDEF123456789012345678901234",
"daily_memory_time_quota": 0,
"default_host_name": "my-function-app.azurewebsites.net",
"enabled": true,
"enabled_host_names": [
"my-function-app.azurewebsites.net",
"my-function-app.scm.azurewebsites.net"
],
"external_id": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/example-rg/providers/Microsoft.Web/sites/my-function-app",
"host_names": [
"my-function-app.azurewebsites.net"
],
"host_names_disabled": false,
"https_only": true,
"hyper_v": false,
"is_xenon": false,
"key_vault_reference_identity": "SystemAssigned",
"kind": "functionapp",
"last_modified_time_utc": "2025-10-20T18:07:00.17Z",
"location": "East US",
"name": "my-function-app",
"outbound_ip_addresses": "10.0.0.1,10.0.0.2,10.0.0.3",
"possible_outbound_ip_addresses": "10.0.0.1,10.0.0.2,10.0.0.3,10.0.0.4,10.0.0.5",
"redundancy_mode": "None",
"repository_site_name": "my-function-app",
"reserved": false,
"resource_group": "example-rg",
"scm_site_also_stopped": false,
"server_farm_id": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/example-rg/providers/Microsoft.Web/serverfarms/ASP-example",
"site_config_acr_use_managed_identity_creds": false,
"site_config_always_on": false,
"site_config_ftps_state": "FtpsOnly",
"site_config_function_app_scale_limit": 200,
"site_config_min_tls_version": "1.2",
"site_config_net_framework_version": "v6.0",
"site_config_number_of_workers": 1,
"site_config_publishing_username": "REDACTED",
"state": "Running",
"storage_account_required": false,
"subscription_id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"subscription_name": "example-subscription",
"type": "Microsoft.Web/sites",
"usage_state": "Normal"
},
"display_name": "my-function-app",
"region": "eastus"
},
"compliance": {
"evaluation": "pass"
},
"description": "This rule identifies when an Azure Function has administrative level permissions at the subscription scope. Administrative Azure role assignments at the subscription scope grant extensive privileges that can affect all resources within the subscription. This broad access increases the risk of accidental or malicious changes. Remediation: Datadog recommends reducing the permissions and scope of a role assignment to the minimum necessary. Where possible, assign roles at the resource group or individual resource level and use built-in roles with limited privileges tailored to operational requirements.",
"detection_changed_at": 1766084844000,
"finding_id": "ZXhhbXBsZS1pZGVudGl0eS1yaXNrLTEyMzQ1Ng==",
"finding_type": "identity_risk",
"first_seen_at": 1766084844000,
"is_in_security_inbox": false,
"last_seen_at": 1766093845000,
"metadata": {
"schema_version": "2"
},
"resource_id": "abc123def456789012345678901234ab",
"resource_name": "my-function-app",
"resource_type": "azure_function",
"risk": {
"has_privileged_access": false
},
"risk_details": {
"has_privileged_access": {
"value": false
}
},
"rule": {
"default_rule_id": "def-000-s2l",
"id": "def-000-s2l",
"name": "Azure function has admin level privileges at the subscription scope",
"type": "cloud configuration",
"version": 5
},
"severity": "medium",
"severity_details": {
"adjusted": {
"score": 5.5,
"value": "medium",
"value_id": 2
}
},
"status": "open",
"tags": [
"scored:true",
"security:compliance",
"scope:azure.security",
"cloud_provider:azure",
"dd_rule_type:ciem",
"operating_system:windows",
"source:azure.security",
"region:eastus"
],
"title": "Azure function has admin level privileges at the subscription scope",
"workflow": {
"mute": {
"is_muted": false
}
}
}
