Do Azure Functions Linux hosts in Azure Government run in FIPS mode

Azure Functions Linux Elastic Premium does not expose or publicly guarantee a customer-configurable host-kernel FIPS mode, so if host-level FIPS enforcement is an explicit requirement, use a platform with a documented and verifiable host control—such as AKS FIPS-enabled node pools—after confirming availability in your Azure Government region and subscription.

Azure Functions host behavior

The disabled kernel FIPS flag you observed is consistent with Azure’s documented model: Microsoft does not enforce FIPS mode by default across Azure. Instead, Azure services use FIPS-approved algorithms and implementations that are validated, or derived from validated implementations. FIPS validation applies to cryptographic modules, not an entire application or cloud service.^1^

For your specific configuration:

• A custom Functions container controls the immediate runtime environment of the function code, not the underlying Elastic Premium worker host or its kernel configuration.^2^
• Microsoft documents Linux custom-container deployment on Elastic Premium, but the hosting options do not expose a host-level FIPS setting.^3^
• Public documentation does not make a service-specific commitment that Linux Elastic Premium workers in Azure Government boot with kernel FIPS mode enabled.

Therefore, do not treat the container’s kernel flag as something that can be enabled through the Docker image or Function App settings. For a definitive audit statement covering the exact Azure Government region, Elastic Premium SKU, and host image, request written confirmation through Azure support.

FedRAMP interpretation

FedRAMP requires FIPS-validated or NSA-approved cryptography under SC-13. Microsoft also states that a system relying on FIPS validation must operate the relevant cryptographic module according to its approved mode and security policy.^1^

Consequently:

• A FIPS-enabled container alone does not automatically establish compliance for the complete system.
• A disabled host kernel flag alone does not automatically establish noncompliance for a managed PaaS service.
• The assessment must identify the cryptographic boundary, the modules performing each security function, their CMVP validation status, and whether they are operating according to their security policies.
• Azure Government’s broader FIPS position confirms that Microsoft uses FIPS-validated modules across many cloud-service components, but it does not constitute a Linux Functions host-kernel-mode guarantee.^4^

Document the shared-responsibility boundary, your container’s cryptographic modules and configuration, and Microsoft’s service evidence. Have the resulting control implementation accepted by your authorizing authority or assessor rather than assuming that either kernel flag determines acceptance.

When host-level FIPS is mandatory

AKS is a documented option providing an explicit, queryable FIPS property on its node pools; it should not be described as Microsoft’s universal recommendation for every Functions workload.

Before migrating:

1. Confirm that AKS, FIPS-enabled node pools, the intended VM family, and the chosen OS SKU are available in your specific Azure Government region and subscription.
2. Configure Azure CLI for your Azure Government tenant, sign in, and select the correct subscription.
3. Create the cluster or node pool with FIPS enabled. Azure Linux 3.0 is listed as supporting FIPS-enabled AKS node pools, but FIPS is disabled by default.^5^

Example from the AKS guidance:

az aks create \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --node-count 3 \
  --enable-fips-image

az aks show \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --query="agentPoolProfiles[].{Name:name,enableFips:enableFips}" \
  -o table

The expected verification result is enableFips=True for every node pool that can run the workload. Ensure additional node pools are also created with FIPS enabled.

Important limitations:

• A FIPS-enabled Linux node uses a different image from the default Linux node image.
• Node image upgrades are required to update the underlying FIPS packages and modules.
• Microsoft explicitly states that container images running on FIPS nodes are not assessed for FIPS compliance; the application image and its crypto libraries remain your responsibility.
• CIFS mounts can fail because FIPS disables some authentication modules.^5^

This makes AKS suitable when the control specifically requires a demonstrably FIPS-enabled host, provided regional availability and the additional operational responsibility of running Kubernetes are acceptable.

References

1. Federal Information Processing Standard (FIPS) 140
2. Linux container support in Azure Functions
3. Deployment technologies in Azure Functions (container-apps)
4. Azure for public safety and justice
5. Enable Federal Information Processing Standard (FIPS) for Azure Kubernetes Service (AKS) node pools (bicep)