Remote debugging should be turned off for Function App

What does the recommendation "Remote debugging should be turned off for Function App" check?

Flags any Function App whose site configuration has 'remoteDebuggingEnabled' set to true, which lets a developer attach a debugger from Visual Studio over an inbound port the platform opens for the session. It reads the live 'Microsoft.Web/sites/config' property on the app, so it reflects the current runtime state rather than a deployment template default. It does not inspect deployment slots, which carry their own separate config and are covered by a different recommendation, and it does not check the remote debugging version, the source IP restrictions, or whether anyone is actually attached right now. It also says nothing about how the app authenticates its triggers or whether its outbound traffic is locked down; its sole job is to confirm the debug channel is closed.

Why does "Remote debugging should be turned off for Function App" matter?

Remote debugging opens an inbound debug channel and pins the app to a specific Visual Studio version, and a left-on session is an unauthenticated path that can expose in-memory secrets, connection strings and request payloads to anyone who reaches the port. It is almost always a leftover from a troubleshooting session that should have been temporary, so finding it on means the app is running wider than intended and that change control was bypassed. The business consequence is twofold: a widened attack surface that scanners can probe, and a finding that fails the Microsoft cloud security benchmark posture checks auditors review. Turning it off removes the listening surface entirely and keeps the function reachable only through its normal HTTPS triggers, which is the behaviour you want in production.

How do I fix "Remote debugging should be turned off for Function App"?

1. In the portal, open the Function App, go to Settings then Configuration then General settings, and set Remote debugging to Off; this clears the 'remoteDebuggingEnabled' property on the app.
2. To script it, run: az functionapp config set --resource-group <rg> --name <app> --remote-debugging-enabled false, then confirm with az functionapp config show --query remoteDebuggingEnabled.
3. To prevent regressions at scale, assign the built-in audit policy by display name rather than a hardcoded GUID: pid=$(az policy definition list --query "[?displayName=='Function apps should have remote debugging turned off'].name" -o tsv); az policy assignment create --name funcapp-remote-debug-off --policy "$pid" --scope <scope>.

# Close the highest-impact Function app exposure first: wildcard CORS, remote
# debugging, weak TLS, and missing client certificates, app by app.
RG=my-rg
APP=ordersapiprod

# 1. Replace wildcard CORS with the origins that actually call the app.
az functionapp cors remove -g "$RG" -n "$APP" --allowed-origins "*"
az functionapp cors add    -g "$RG" -n "$APP" \
  --allowed-origins https://app.contoso.com https://admin.contoso.com

# 2. Turn off remote debugging and require modern TLS.
az functionapp config set -g "$RG" -n "$APP" \
  --remote-debugging-enabled false \
  --min-tls-version 1.2

# 3. Require incoming client certificates where the app expects them.
az functionapp update -g "$RG" -n "$APP" \
  --set clientCertEnabled=true --set clientCertMode=Required

# 4. Put App Service Authentication (Easy Auth) in front of an HTTP-triggered app
#    so anonymous callers are rejected before they reach your code.
az webapp auth update -g "$RG" -n "$APP" \
  --enabled true \
  --action LoginWithAzureActiveDirectory \
  --aad-client-id "$CLIENT_ID" \
  --aad-token-issuer-url "https://sts.windows.net/$TENANT_ID/"

# 5. Ratchet it shut: audit any future app that ships without authentication.
#    Look the built-in policy up by its exact display name, never hardcode the GUID.
pid=$(az policy definition list \
  --query "[?displayName=='Function apps should have authentication enabled'].name" -o tsv)
az policy assignment create \
  --name audit-funcapp-auth \
  --policy "$pid" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"