VIEW RULE IN DATADOG

Description

A publicly accessible Azure Function App has an assigned managed identity with administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. If the function app is compromised, an attacker could use the managed identity to control resources and security settings within that scope.

Remediation

1. Restrict public network access to the function app by configuring inbound access restrictions or a private endpoint. See Azure Functions networking options.
2. Remove administrator-equivalent role assignments from the managed identity and grant only the permissions required by the workload. See Remove Azure role assignments.