services / Azure / Web Apps Functions host system keys

Azure Functions host system keys are app-level bearer credentials that authorize the Functions runtime admin API and privileged extension webhook endpoints (e.g. Durable Functions, Event Grid extension) of a function app.

These keys are credential material gating privileged/admin invocation of the function app; functions invoked with them run under the app's assigned managed identity.

Microsoft.​Web/​Sites/​host/​systemkeys/​delete

Deleting host system keys destroys the credential material and revokes the access that extensions/integrations (Event Grid, Durable Functions) and operators depend on, denying authorized access and breaking those privileged endpoints.

Risks

1. Cryptographic destruction (CRITICAL)
2. Denial-of-service (HIGH)
3. Denial-of-access (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links