---
title: >-
  Publicly accessible Azure Function App has an assigned managed identity that
  can read data from crown jewel storage
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Publicly accessible Azure Function App
  has an assigned managed identity that can read data from crown jewel storage
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Publicly accessible Azure Function App has an assigned managed identity that can read data from crown jewel storage

## Description{% #description %}

A publicly accessible Azure Function App has an assigned managed identity that can read data from a crown jewel blob container. If the function app is compromised, an attacker could use the managed identity to read or exfiltrate business-critical data.

## Remediation{% #remediation %}

1. Restrict public network access to the function app by configuring inbound access restrictions or a private endpoint. See [Azure Functions networking options](https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options#inbound-access-restrictions).
1. Remove unnecessary Blob data read permissions from the managed identity. See [Remove Azure role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove).