Azure Function Scanning - Overview
Qualys Container Security discovers and scans Microsoft Azure Function Apps for vulnerabilities and software composition analysis (SCA) findings. Azure Function scanning extends Qualys serverless coverage from AWS Lambda to Azure, giving you a unified security view across cloud providers from a single place in the Qualys Enterprise TruRisk™ Platform.
Azure Functions is a serverless compute service that runs event-driven code without requiring infrastructure management. Like other serverless workloads, Function Apps introduce unique security risks: vulnerable dependencies in packaged code, risks from unscanned container images used as runtimes, and misconfigurations in function permissions. Qualys addresses these risks by continuously detecting and scanning Function Apps as they are created, updated, or deleted across all onboarded Azure subscriptions.
How Azure Function Scanning Works
Azure Function scanning uses an event-driven architecture deployed in your Azure environment. All scanning runs inside a designated service subscription; target subscriptions contain no scanning infrastructure.
- Real-time detection: Azure Event Grid captures ARM write and delete operations for Function Apps (Microsoft.Web/sites/Write and Microsoft.Web/sites/Delete) at the subscription level. Events are delivered via a Service Bus queue to the cloud-operator Container App in the service subscription, which processes them immediately.
- Initial scan: When the service subscription stack is deployed, the cloud-operator automatically discovers and scans all existing Function Apps in the service subscription. When a new target subscription is onboarded, a one-time onboarding message triggers a backfill scan of all existing Function Apps in that subscription.
- Cross-subscription scanning: Target subscriptions deploy a lightweight Bicep stack that forwards Function App events to the service subscription’s Service Bus queue using a managed identity. The cloud-operator then assumes cross-subscription Managed Identity Reader access to download and scan Function App code.
- Automatic multi-region coverage: The Event Grid system topic is subscription-scoped (topicType: Microsoft.Resources.Subscriptions, location: global), so it captures Function App events from every Azure region in a subscription automatically. No per-region deployment is needed.
- Deduplication: Atomic writes to Azure Cosmos DB prevent redundant scans for the same Function App.
- Dead-letter handling: Scan requests that fail after 10 delivery attempts are moved to a Service Bus dead-letter queue for administrator investigation.
What Azure Function Scanning Covers
For each discovered Function App, Qualys scans the following.
| Scan Target | Description |
|---|---|
| Image-based Azure Functions | Function Apps deployed as container images are pulled from the registry and scanned for OS and application vulnerabilities. |
| Deployment (Zip) Azure Functions | Function Apps deployed as ZIP packages are downloaded and scanned for vulnerable dependencies and libraries. |
| Software composition analysis (SCA) | Open-source packages and dependencies embedded in the Function App are identified and assessed for known vulnerabilities. |
Supported Configurations
The following table lists Azure Function App hosting plans, worker models, and deployment configurations, and indicates whether Qualys scanning is supported for each.
| SKU Model | Capability / Scenario | Supported |
|---|---|---|
| App Service Plan (Dedicated) |
Linux Dedicated (B1/B2) | ✅Yes |
| Windows Dedicated (B1) | ✅Yes | |
| Consumption (Dynamic) | Linux Consumption — package reachable via Kudu wwwroot | ✅Yes |
| Linux Consumption — package only in scm-releases | ❌No | |
| Windows Consumption plan | ✅Yes | |
| Dedicated | FTPS file upload | ✅Yes |
| Elastic Premium | Linux Elastic Premium (EP1) | ✅Yes |
| Windows Elastic Premium (EP1) | ❌No | |
| Flex Consumption | Flex Consumption | ❌No |
| .NET isolated — Flex Consumption | ❌No | |
| Isolated v2/v3 | App Service Environment (Isolated) | ❌No |
| Premium / Dedicated | Deployment slots (/slots/) | ❌No |
| Not Applicable | Azure Files content share (when Kudu unreachable) | ❌No |
| Container-deployed function apps (DOCKER| linuxFxVersion, functionAppConfig image) using ACR / MCR / Docker Hub registry pull | ✅Yes | |
| .NET in-process worker | ✅Yes | |
| .NET isolated — classic hosting (wwwroot / SitePackages / RFP URL) | ✅Yes | |
| SCM_RUN_FROM_PACKAGE | ❌No | |
| Source Repository like GitHub | ❌No | |
| WEBSITE_RUN_FROM_PACKAGE=1 - SitePackages using packagename.txt |
✅Yes | |
| WEBSITE_RUN_FROM_PACKAGE = SAS URL | ✅Yes | |
| WEBSITE_RUN_FROM_PACKAGE = bare blob URL | ❌No | |
| WEBSITE_RUN_FROM_PACKAGE = Key Vault reference | ❌No |
Where to View Scan Results
Azure Function scan results are available from:
Container Security > Assets > Serverless Functions
From this view you can see discovered Function Apps with vulnerability counts, severity ratings, TruRisk™ Score, and installed software inventory across all onboarded Azure subscriptions.
Deployment Model
Azure Function scanning is deployed using Bicep templates provided by Qualys. The deployment consists of two stacks.
- Service subscription stack: Deploys the cloud-operator Container App, Service Bus queues, Cosmos DB, Event Grid resources, and associated managed identities. This is the central scanning and orchestration subscription.
- Target subscription stack: Deploys an Event Grid system topic, event forwarding rules, and a managed identity in each Azure subscription you want to scan. The target subscription automatically registers itself with the service subscription on stack deployment.
Unlike AWS Lambda scanning, no per-region deployment is required. One target subscription stack covers all Azure regions in that subscription.
For deployment steps, see Scan Serverless Azure Function.
Key Concepts
-
Service Subscription
The Azure subscription where the Qualys cloud scanning infrastructure is deployed. It hosts the cloud-operator Container App, Service Bus queues, Cosmos DB tables, Event Grid resources, and Azure Monitor alerts. The service subscription serves as the central scanning and orchestration hub. -
Target Subscription
An Azure subscription that contains the Function Apps you want Qualys to scan. The target subscription does not host the main scanning infrastructure. It contains only Event Grid forwarding resources and a managed identity that sends Function App events to the service subscription. -
cloud-operator
An always-on Azure Container App deployed in the service subscription that receives Function App events from Service Bus, checks Cosmos DB for deduplication, and launches the embedded qscanner binary to perform vulnerability scans. -
Onboarding Notifier
A one-time trigger that fires automatically when the target subscription stack is deployed or updated. It sends a single onboarding message to the service subscription’s qualys-onboarding-events Service Bus queue, registering the subscription and triggering a backfill scan of existing Function Apps. No manual action is required.