Azure Functions are a powerful serverless computing platform offered by Microsoft Azure. When designing and developing Azure Functions, it is crucial to prioritize security to ensure the confidentiality, integrity, and availability of the functions and their resources.

There are several aspects of security to consider when designing and developing Azure Functions. These factors cover various aspects of security, including authentication, authorization, network security, secure operation, and deployment. 

Overview:

Azure Functions, part of Azure App Service, provides a serverless execution environment for building and hosting applications.

Ensuring the security of these functions is critical and involves several aspects:

1. Authentication and Authorization:

Authentication and authorization are fundamental components of securing Azure Functions. The Azure Active Directory (AAD) and Enterprise Identity Manager (EIDM) provide robust authentication and authorization capabilities. By integrating Azure AD/EIDM, we can leverage features such as single sign-on (SSO), multi-factor authentication (MFA), and role-based access control (RBAC) to restrict access to Azure Functions.

2. Secure Operation:

Azure Functions provide a secure and isolated environment to run code. However, it is important to ensure that functions are properly configured to minimize the risk of unauthorized access and exploitation. This includes implementing secure coding practices, using secure coding frameworks, and following secure software development lifecycle (SDLC) guidelines. Additionally, monitoring the function logs and enforcing secure coding policies can help identify and mitigate potential security threats.

3. Network Security:

Network security is equally important for securing Azure Functions. To ensure data confidentiality and integrity, network security policies should be implemented. This includes using secure communication protocols like HTTPS, configuring firewalls and network virtual appliances, and using virtual private networks (VPNs) to connect securely to the Azure Functions runtime. Additionally, implementing network segmentation and access controls can help limit access to critical resources.

4. Secure Deployment:

Secure deployment of Azure Functions is crucial for safeguarding the underlying infrastructure and resources. Follow secure deployment practices, such as leveraging Azure Key Vault to store secrets securely, using Azure DevOps for continuous integration and continuous deployment (CI/CD), and leveraging Azure Monitor for real-time monitoring and alerting. Additionally, regularly reviewing and updating Azure Function configuration files and dependencies can help protect against security vulnerabilities.

5. Access Secure Azure Function Using the Key:

One of the key considerations for securing the Azure Function is controlling access to the function using a unique key. This key serves as a credential to authenticate and authorize calls to the function. By securely storing the key in Azure Key Vault and using Azure Functions authentication capabilities, we can enforce access controls and protect against unauthorized access.

Securing Azure Functions with Azure Active Directory

Let’s explore how can we secure Azure Functions with Azure Entra ID.When working with sensitive data or performing critical operations, it is essential to secure these functions to prevent unauthorized access. One way to achieve this is by integrating Azure Active Directory (Azure AD) with Azure Functions. In this article, we will explore the process of securing Azure Functions using Azure AD with practical examples.

Overview of Entra ID

Azure Active Directory (Azure AD) is a cloud-based identity and access management service from Microsoft. It provides a single place to manage user identities and access to applications and resources, both on-premises and in the cloud. Azure AD supports various authentication protocols, including OAuth 2.0 and OpenID Connect, making it suitable for securing modern applications and APIs.

Why Secure Azure Functions with Entra ID?

Securing Azure Functions with Azure AD offers several benefits, including:

Centralized Identity Management

By leveraging Entra ID, you can manage user identities centrally, making it easier to control access to your functions and other Azure resources.

Multi-Factor Authentication (MFA)

You can enable Multi-Factor Authentication for additional security, ensuring that users must provide more than one form of identification before gaining access.

Fine-Grained Access Control

Azure AD allows you to define fine-grained access policies, restricting access to specific users or groups of users.

Prerequisites

Before proceeding with securing Azure Functions with Entra ID you need to have the following in place:

Azure Subscription: You must have an active Azure subscription to create and manage Azure Functions and Azure AD.

Azure Function App: Create an Azure Function App in the Azure portal. You can create functions within this app that will be secured using Azure AD.

Azure Active Directory (Azure AD) Tenant: You need an Azure AD tenant to configure the necessary authentication settings.

Demo

Steps to Secure Azure Functions with Entra ID

Now, let’s walk through the steps to secure Azure Functions using Azure AD:

Demo (Step-by-step)

Create Azure Function in Visual Studio.

Use the below code to use Authentication:

using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.AspNetCore.Http;
using System.Security.Claims;

public static class SecureFunction
{
    [FunctionName("SecureFunction")]
    public static IActionResult Run(
        [HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = null)] HttpRequest req,
        ClaimsPrincipal claimsPrincipal)
    {
        // Check if the user is authenticated
        if (!claimsPrincipal.Identity.IsAuthenticated)
        {
            return new UnauthorizedResult();
        }

        // Your function logic goes here
        // ...

        return new OkResult();
    }
}

Code without Auth

Code with Auth

Configure Authentication for Azure Functions

Add an Identity provider

Set Permissions: User.Read

Complete all the above settings!

Validate the Azure Function:

Now, once you click on Secure Function link, it redirects to Auth Page !

To use/consume this Azure Function, you need to use the key with http request.

If your function app is using App Service Authentication / Authorization, you can view information about authenticated clients from your code. This information is available as request headers injected by the platform.

You can also read this information from binding data. This capability is only available to the Functions runtime in 2.x and higher. It is also currently only available for .NET languages.

Authorization level

The authorization level is a string value that indicates the kind of authorization key that’s required to access the function endpoint. For an HTTP triggered function, the authorization level can be one of the following values:

API key authorization

Most HTTP trigger templates require an API key in the request. So your HTTP request normally looks like the following URL:

HTTP
https://<APP_NAME>.azurewebsites.net/api/<FUNCTION_NAME>?code=<API_KEY>

The key can be included in a query string variable named code, as above. It can also be included in an x-functions-key HTTP header. The value of the key can be any function key defined for the function, or any host key.

https://<APP_NAME>.azurewebsites.net/api/<FUNCTION_NAME>?code=<API_KEY>

You have now successfully consumed the Secured Azure Functions!

Conclusion

Securing Azure Functions involves a comprehensive approach that includes secure operation practices, vigilant deployment strategies, robust network security measures, thoughtful design considerations, and the use of Azure Functions Proxy when necessary. By adhering to these principles, developers can ensure that their serverless applications are protected against a wide range of security threats. This security framework not only safeguards the applications but also contributes to the overall integrity and reliability of the Azure cloud ecosystem.

This article covered the necessary steps to register your Azure Function App in Azure AD, configure authentication settings, and protect your functions using the [Authorize] attribute.

By following these steps and best practices, you can ensure that your Azure Functions are accessible only to authorized users, mitigating security risks, and protecting sensitive data.

Next Step:

As mentioned in the beginning there are multiple aspects of security and securing Azure Function (e.g, ) and we explored how to secure Azure Function using Azure AD/Entra ID and using Authorize attrite, and access secure Azure Function using the key.

Below are the other factors that we need to consider while designing and developing Azure Functions. Lets have a view on this.

Azure Functions security is multifaceted, encompassing secure operation, deployment, and network security. Here’s a breakdown of the key points:

Secure Operation:

• Defender for Cloud: Protects Azure resources.
• Log and Monitor: Tracks function performance and logs.
• Require HTTPS: Ensures secure connections.
• Function Access Keys: Controls access to functions.
• Authorization Scopes: Defines function-level permissions.
• Master Key: Grants admin-level access.
• System Key: Used for system-level integrations.
• Keys Comparison: Differentiates between keys based on scope and usage.
• Secret Repositories: Stores sensitive information securely.
• Authentication/Authorization: Manages user identities and access.
• Permissions: Handles user management permissions.
• Managed Identities: Automates credentials management.
• Restrict CORS Access: Limits cross-origin requests.
• Managing Secrets: Safeguards application secrets.
• Application Settings: Configures app settings securely.
• Key Vault References: Integrates with Azure Key Vault for secret management.
• Identity-based Connections: Uses identities for secure connections.
• Data Validation: Ensures data integrity.

Secure Deployment:

• Deploy in Isolation: Isolates function app for enhanced security.
• Secure the SCM Endpoint: Protects the source control management endpoint.

Network Security:

• Network Security: Implements measures to protect against network threats.

Conclusion: To maintain robust security within Azure Functions, it’s essential to implement secure operational practices, ensure secure deployments, and enforce stringent network security measures. By doing so, developers can safeguard their serverless applications against potential threats, contributing to the overall security and reliability of the Azure platform. This comprehensive approach to security is crucial for building trust and maintaining the integrity of cloud-based applications.

References:

Securing Azure Functions | Microsoft Learn

Configure Microsoft Entra authentication – Azure App Service | Microsoft Learn

Azure Functions HTTP trigger | Microsoft Learn