How we can secure calling our Azure Function

Question

I want to develop an Azure Function using .net core 10, which is triggered using http call. now we only need to call this azure service from our internal CRM system, so how we can achieve this security level? Thanks and what are the options we have?

Answer 1

Hi ,

Thanks for reaching out to Microsoft Q&A.

If your azure func is HTTP-triggered and should only be called by your internal CRM application, I would not rely solely on a Function Key for production workloads.

Recommended approach: Microsoft Entra ID authentication

1. Register the Azure Function as an API in Microsoft Entra ID.
2. Enable App Service Authentication (Easy Auth) on the Function App.
3. Configure the CRM application to authenticate using a Managed Identity (preferred) or Service Principal.
4. Have the CRM acquire an OAuth 2.0 access token and call the Function using: Authorization: Bearer <access-token>
5. Validate that the token is issued for the expected audience (the Function API).
6. Create an application role (for example, Function.Invoke) and assign it only to the CRM application. This ensures that only authorized applications can invoke the Function

Add network levvel security:

If the CRM is hosted within your corporate or Azure network, consider restricting network access to the Function:

• Use Private Endpoint and private DNS to make the Function accessible only through private connectivity.
• Disable public access where possible.
• If Private Endpoint is not feasible, configure IP access restrictions or VNet integration as an additional layer of protection.

Recommendation:

For an internal CRM integration, the preferred approach is:

CRM -> Microsoft Entra ID -> Azure Function

If the CRM is Azure-hosted, use Managed Identity instead of client secrets whenever possible.

A useful way to think about this is:

• Authentication answers: Who is calling the Function?
• Network isolation answers: Where can the Function be called from?

Combining Microsoft Entra ID auth with Private Endpoint/network restrictions provides a strong and commonly recommended security model for internal enterprise applications.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.