Azure Functions Flex Consumption Linux Easy Auth — How can rejected 401 requests be correlated before application execution?

Question

We need Microsoft employee or App Service Authentication / Azure Functions platform-team confirmation of the supported evidence method for a pre-production security acceptance check.

Environment: Azure Functions Flex Consumption (FC1), Linux, Node.js; App Service Authentication (Easy Auth) enabled; Microsoft Entra provider; Require authentication enabled; unauthenticated action Return401; no excluded application paths configured. The HTTP Function uses authLevel=anonymous at the Function-key layer, with Easy Auth protecting the application boundary. No authentication settings were weakened for testing.

Observed in one controlled test interval:

• One valid authenticated control request produced a complete correlated application and downstream model trace.
• Invalid, expired, and wrong-audience token cases were each executed once and each returned HTTP 401/access denied.
• The Easy Auth diagnostic detector reported three authentication rejections in the controlled interval.
• We found no corresponding application/model traces for those rejected requests, no stale answer, and no downstream business mutation.
• The diagnostic output available to us did not expose enough individual linkage to map each client request to its corresponding Easy Auth rejection.

The absence of an application trace and an aggregate rejection count are not being treated as independent proof for each individual request. We are not reporting a demonstrated authentication bypass.

Microsoft documents the platform-first authentication boundary here:

https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization

The AppServiceAuthenticationLogs table documents a CorrelationId column here:

https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/appserviceauthenticationlogs

We understand that a table schema alone does not establish support for every hosting-plan/export combination.

Questions:

1. Is this lack of individual rejection correlation expected on Azure Functions Flex Consumption on Linux?
2. Does AppServiceAuthenticationLogs currently support per-request rejection correlation on this plan/OS combination?
3. Which supported diagnostic category, destination and query expose a platform request ID or CorrelationId for Easy Auth 401 responses? How should that ID be linked to the originating client request?
4. With Require authentication configured and no excluded application paths, can a request rejected by Easy Auth reach the Function/application execution path?
5. What evidence method does Microsoft recommend to prove that an individual request rejected by Easy Auth did not invoke the Function, where application telemetry correctly has no corresponding invocation?
6. Is there a current Flex Consumption/Linux limitation affecting authentication-log export or correlation? If so, is there a documented alternative that preserves the existing authentication configuration?

We are not asking how to obtain a 401. We need authoritative confirmation or supported platform telemetry for rejection before application execution. Please identify whether the answer is official platform guidance and, if needed, route this to App Service Authentication / Azure Functions engineering. We can provide sanitized resource-specific diagnostics through an appropriate private Microsoft channel; no tokens, tenant identifiers, application identifiers, business records or private logs are included in this public post.