Standard audit workflow
Structured quick-reference sections for prerequisites, installation, usage, and troubleshooting.
Prerequisites
- PowerShell 5.1+ with Azure PowerShell (Az) module installed and configured
- Azure subscription access with appropriate RBAC permissions (Reader role minimum)
- Valid Azure credentials configured via Connect-AzAccount or service principal authentication
- Function App read permissions across target subscriptions and resource groups
- Network connectivity to Azure APIs and sufficient API quota for discovery operations
Permission scope
Start with Reader access and a single subscription/resource group. Validate the findings and report format before expanding to multi-subscription scans.
Key parameters
| Parameter | What it does | When to use it |
|---|---|---|
| -SubscriptionId | Targets a single Azure subscription | Default starting point for most audits |
| -ResourceGroupName | Limits scope to one resource group | Focused review or pilot rollout |
| -FunctionAppName | Targets a specific Function App | Deep dive on a high-risk / critical app |
| -HtmlReportPath | Sets custom HTML output path | Save reports to shared review location |
| -CsvReportPath | Sets custom CSV output path | Automation pipelines / BI ingestion |
Standard audit workflow
- 1Authenticate to Azure (`Connect-AzAccount`) and confirm the target subscription.
- 2Run a single-subscription scan first and review the HTML report for obvious security misconfigurations.
- 3Use CSV output for remediation tracking or import into your existing governance workflow.
- 4Expand to multi-subscription runs after validating output paths and permissions.
.\Azure-FunctionAppAudit.ps1 -SubscriptionId"your-sub-id" -ResourceGroupName"my-rg" -FunctionAppName"my-function-app".\Azure-FunctionAppAudit.ps1 -SubscriptionId"your-sub-id".\Azure-FunctionAppAudit.ps1 -SubscriptionIds"sub-id-1","sub-id-2" -HtmlReportPath"C:\Reports\MultiSubAudit.html"Audit coverage snapshot
| Category | Coverage | Focus |
|---|---|---|
| Security Configuration | 15+ security checks | HTTPS-only settings, authentication methods, and security protocols |
| Identity & Access | 8+ identity checks | Managed Identity configuration and authentication settings |
| Networking & VNet | 10+ networking checks | VNet integration, IP restrictions, and network security settings |
| Runtime & Performance | 12+ runtime checks | Runtime versions, language settings, and performance configurations |
| Monitoring & Logging | 6+ monitoring checks | Application Insights integration and logging configuration |
Coverage counts are the page-level guidance summary. Always review the generated report details before remediation.
Expected report outputs
The tool generates both technical and stakeholder-friendly outputs so engineering and governance teams can review the same run.
| Output | Primary audience | What it contains |
|---|---|---|
| CSV report | Ops / FinOps analysts | Row-level findings for filtering, remediation tracking, and automation |
| HTML report | Security / leadership | Visual summary, categorized findings, and remediation guidance |
- Run on a small scope first to validate output directories and HTML rendering in your environment.
Troubleshooting
- If no Function Apps are returned, verify the subscription scope and Reader permissions on the target resources.
- If report files are missing, use explicit `-HtmlReportPath` / `-CsvReportPath` values and ensure the directory exists.
- If scans are slow in large estates, start with resource-group scope to validate the baseline before expanding.
Comprehensive Audit Features
Enterprise-grade Function App security and configuration analysis for Azure
Security Posture Assessment
Identifies critical security misconfigurations and vulnerabilities in Function Apps with comprehensive analysis
Configuration Best Practices
Audits Function App settings against Azure recommendations for optimal performance and reliability
Networking & Access Control Review
Examines VNet integration, IP restrictions, and authentication settings for secure access
Identity & Authentication Audit
Verifies Managed Identity usage and flags insecure authentication methods
Runtime & Language Version Check
Ensures Function Apps are running on supported and secure runtime versions
Monitoring & Logging Verification
Confirms proper Application Insights integration for comprehensive observability
Detailed HTML & CSV Reports
Generates comprehensive reports for easy analysis and executive summaries
Cost Optimization Insights
Highlights configurations that might lead to unnecessary operational costs
Comprehensive Audit Categories
50+ configuration checks across critical security and compliance areas
Audit Coverage Areas
Usage Examples
Real-world scenarios for effective Azure Function App auditing
Audit a Single Function App
Focus on specific Function App for detailed analysis
.\Azure-FunctionAppAudit.ps1 -SubscriptionId"your-sub-id" -ResourceGroupName"my-rg" -FunctionAppName"my-function-app"Perfect for targeted analysis of critical Function Apps with detailed configuration review
Scan All Function Apps in Subscription
Comprehensive audit across entire Azure subscription
.\Azure-FunctionAppAudit.ps1 -SubscriptionId"your-sub-id"Ideal for organization-wide governance and compliance assessment
Audit Across Multiple Subscriptions
Enterprise-scale auditing with centralized reporting
.\Azure-FunctionAppAudit.ps1 -SubscriptionIds"sub-id-1","sub-id-2" -HtmlReportPath"C:\Reports\MultiSubAudit.html"Essential for large organizations with multiple Azure subscriptions requiring unified governance
Generate Only CSV Report
Structured data output for automated processing
.\Azure-FunctionAppAudit.ps1 -SubscriptionId"your-sub-id" -CsvReportPath"C:\Reports\FunctionAudit.csv" -NoHtmlReportPerfect for integration with existing analytics pipelines and automated compliance workflows
Technical Specifications
Enterprise-grade requirements and comprehensive feature documentation
Requirements
- PowerShell 5.1+ with Azure PowerShell (Az) module installed and configured
- Azure subscription access with appropriate RBAC permissions (Reader role minimum)
- Valid Azure credentials configured via Connect-AzAccount or service principal authentication
- Function App read permissions across target subscriptions and resource groups
- Network connectivity to Azure APIs and sufficient API quota for discovery operations
Parameters
Core Analysis Features
Security Analysis
- • HTTPS-only configuration verification
- • Authentication and authorization settings
- • Managed Identity configuration review
- • Key Vault integration assessment
Configuration Compliance
- • Runtime version and language settings
- • VNet integration and networking review
- • Application Insights integration check
- • Performance and scaling configuration
Professional Reporting
Dual-format output for technical analysis and executive presentation
CSV Report
Structured data format perfect for analysis, filtering, and integration with existing compliance workflows.
- • Function App configuration details
- • Security and compliance findings
- • Runtime and performance settings
- • Networking and access control data
- • Timestamp and audit metadata
HTML Report
Rich visual presentation with charts, summaries, and executive-friendly formatting for stakeholder communication.
- • Executive summary with key findings
- • Visual compliance status distribution
- • Detailed audit results with recommendations
- • Security and governance insights
- • Professional CloudCostChefs branding
Chef's Tips
Professional best practices for effective Azure Function App auditing
Security Focus
Prioritize security findings like missing HTTPS-only settings, disabled Managed Identity, and missing Application Insights integration for immediate action. These represent the highest risk areas.
Performance Optimization
For large environments, start with targeted resource group audits to understand scope and performance. Use subscription-level audits for comprehensive governance assessments.
Compliance Strategy
Focus on configuration compliance findings for immediate remediation opportunities. Use audit results to establish baseline security and governance standards for your organization.
Report Integration
Use CSV reports for detailed analysis and automation workflows. Share HTML reports with stakeholders for governance visibility. Both formats support compliance tracking and audit trails.
Related CloudCostChefs Tools
Complete your Azure optimization toolkit with these complementary tools
What to do next
Pick the path that fits where you are right now.