diff --git a/internal/services/appservice/helpers/shared_schema.go b/internal/services/appservice/helpers/shared_schema.go
index aaa3d21d64d0..93ee4fc7aad6 100644
--- a/internal/services/appservice/helpers/shared_schema.go
+++ b/internal/services/appservice/helpers/shared_schema.go
@@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/go-azure-helpers/lang/pointer"
 	"github.com/hashicorp/go-azure-helpers/resourcemanager/commonids"
 	"github.com/hashicorp/go-azure-sdk/resource-manager/web/2023-12-01/webapps"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/appservice/validate"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/validation"
@@ -285,6 +286,36 @@ func CorsSettingsSchema() *pluginsdk.Schema {
 		Type:     pluginsdk.TypeList,
 		Optional: true,
 		MaxItems: 1,
+		DiffSuppressFunc: func(k, _, _ string, d *schema.ResourceData) bool {
+			stateCors, planCors := d.GetChange("site_config.0.cors")
+			if stateCors == nil || planCors == nil {
+				return false
+			}
+			stateAttrs := stateCors.([]interface{})
+			planAttrs := planCors.([]interface{})
+
+			// Fixes https://github.com/hashicorp/terraform-provider-azurerm/issues/22879
+			// If the plan wants to set default values and the state is empty; suppress diff
+			if len(stateAttrs) == 0 && len(planAttrs) > 0 && planAttrs[0] != nil {
+				planAttr := planAttrs[0].(map[string]interface{})
+
+				newAllowedOrigins, ok := planAttr["allowed_origins"].(*schema.Set)
+				if !ok {
+					return false
+				}
+
+				newSupportCreds, ok := planAttr["support_credentials"].(bool)
+				if !ok {
+					return false
+				}
+
+				if newAllowedOrigins.Len() == 0 && !newSupportCreds {
+					return true
+				}
+			}
+
+			return false
+		},
 		Elem: &pluginsdk.Resource{
 			Schema: map[string]*pluginsdk.Schema{
 				"allowed_origins": {
diff --git a/internal/services/appservice/linux_function_app_resource_test.go b/internal/services/appservice/linux_function_app_resource_test.go
index ff5f35dd3723..0e4c6e2f3b78 100644
--- a/internal/services/appservice/linux_function_app_resource_test.go
+++ b/internal/services/appservice/linux_function_app_resource_test.go
@@ -1639,7 +1639,15 @@ func TestAccLinuxFunctionApp_corsUpdate(t *testing.T) {
 		},
 		data.ImportStep("site_credential.0.password"),
 		{
-			Config: r.withCorsSupportCredentialsOnly(data, SkuStandardPlan),
+			Config: r.withCorsSupportCredentialsOnly(data, SkuStandardPlan, true),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("kind").HasValue("functionapp,linux"),
+			),
+		},
+		data.ImportStep("site_credential.0.password"),
+		{
+			Config: r.withCorsSupportCredentialsOnly(data, SkuStandardPlan, false),
 			Check: acceptance.ComposeTestCheckFunc(
 				check.That(data.ResourceName).ExistsInAzure(r),
 				check.That(data.ResourceName).Key("kind").HasValue("functionapp,linux"),
@@ -1929,7 +1937,7 @@ resource "azurerm_linux_function_app" "test" {
 `, r.template(data, planSku), data.RandomInteger)
 }
 
-func (r LinuxFunctionAppResource) withCorsSupportCredentialsOnly(data acceptance.TestData, planSku string) string {
+func (r LinuxFunctionAppResource) withCorsSupportCredentialsOnly(data acceptance.TestData, planSku string, enabled bool) string {
 	return fmt.Sprintf(`
 provider "azurerm" {
   features {}
@@ -1948,11 +1956,11 @@ resource "azurerm_linux_function_app" "test" {
 
   site_config {
     cors {
-      support_credentials = true
+      support_credentials = %t
     }
   }
 }
-`, r.template(data, planSku), data.RandomInteger)
+`, r.template(data, planSku), data.RandomInteger, enabled)
 }
 
 func (r LinuxFunctionAppResource) runtimeScaleCheck(data acceptance.TestData, planSku string) string {