Azure Blazor WASM SWA - Managed backend not obeying AuthorizationLevel.Function

Blazor WASM app is allowing public acccess to API endpoints when AuthorizationLevel is set to "Function" - the managed backed is behaving like the AuthorizationLevel is Anonymous.

This function is defined in the Api project within my SWA solution:

[Function("GetSomeData")]
public static async Task Run([HttpTrigger(AuthorizationLevel.Function, "get")] HttpRequestData req)
{
int id = Convert.ToInt16(req.Query["id"]);

SomeObject obj = await ObjectService.Get(Id);

var response = req.CreateResponse(HttpStatusCode.OK);

await response.WriteAsJsonAsync(obj);

return response;
}

When the url for the function is entered into a browser (not only from my local dev machine but from anywhere) the value obj is returned. This is an example all 100+ functions exhibit this behavior.

Calling https:///api/GetSomeData?id=100 brings back the full JSON for obj 100. My understanding is that with an AuthLevel of Function an SWA's managed backend must not be accessible anonymously.

The SWA uses an internal system for Authentication.

Am I misunderstanding what an AuthLevel of Function does? My reading on the topic indicates clearly that a managed backend should not behave this way.

thanks