Continuous deployment for Azure Functions

Azure Functions enables you to continuously deploy changes from a source control repository to a function app. In this workflow, a code update triggers build, packaging, and deployment from your project to Azure. The supported deployment providers and release strategies depend on the hosting plan.

Hosting plan	Recommended CI/CD provider	Deployment and release guidance
Flex Consumption	GitHub Actions or Azure Pipelines	Uses package deployment. Deployment slots aren't supported. Use CI/CD release controls and consider rolling updates for zero-downtime deployments.
Elastic Premium, Dedicated, and Consumption	GitHub Actions or Azure Pipelines	Uses ZIP deployment. When supported by your app, deploy to a staging slot, validate the update, and then swap the slot into production.
Azure Container Apps	Container build and deployment workflow	Deploys a container image. For more information, see Azure Functions on Azure Container Apps overview.

Select your hosting plan at the top of this article to view the continuous deployment guidance that applies to your function app.

For hosting plans that support deployment slots, configure continuous deployment for a staging slot instead of the production slot. Verify updates in staging, and then swap the staging slot into production. If you connect directly to a production slot, make sure that only production-quality code reaches the integrated branch.

For Flex Consumption, configure GitHub Actions or Azure Pipelines. Because Flex Consumption doesn't support deployment slots, retain your deployment history in source control and your CI/CD system so that you can recover from a bad deployment.

For Functions on Azure Container Apps, build and deploy a container image. Deployment slots aren't available. Use revisions and consider a blue-green deployment strategy for zero-downtime releases.

The Deployment Center steps in this article apply to function apps that support App Service source control integration. On the Consumption plan, this integration is supported only on Windows. You can also configure source control integration by using Azure CLI.

Azure Functions supports these sources for continuous deployment to your app:

Azure Repos

Maintain your project code in Azure Repos, one of the services in Azure DevOps. Supports both Git and Team Foundation Version Control. Used with the Azure Pipelines build provider. For more information, see What is Azure Repos?

GitHub

Maintain your project code in GitHub. Supported by all build providers. For more information, see GitHub docs.

Bitbucket

Maintain your project code in Bitbucket. Requires the App Service build service.

Local Git

Maintain your project code in a dedicated Git server that's hosted in the same App Service plan as your function app. This option requires the App Service build service. For more information, see Local Git deployment to Azure App Service.

You can also connect your function app to an external Git repository, but this option requires manual synchronization. For more information about deployment options, see Deployment technologies in Azure Functions.

Note

Continuous deployment options covered in this article are specific to code-only deployments. For Azure Functions on Azure Container Apps, see Azure Functions on Azure Container Apps overview. For a custom container hosted by Azure Functions in a Premium or Dedicated plan, see the Enable continuous deployment of containers to Azure section in Work with containers and Azure Functions.

Flex Consumption supports continuous deployment from Azure Repos by using Azure Pipelines and from GitHub by using GitHub Actions. App Service source control integration, including Bitbucket and Local Git deployments, isn't supported.

For Functions on Azure Container Apps, maintain your source in your preferred repository and use a CI/CD workflow to build and push a container image. Then update your function app to use the new image. For more information, see Deployment and setup for Functions on Azure Container Apps.

Requirements

The unit of deployment for functions in Azure is the function app. For continuous deployment to succeed, the directory structure of your project must be compatible with the basic folder structure that Azure Functions expects. When you create your code project by using Azure Functions Core Tools, Visual Studio Code, or Visual Studio, the Azure Functions templates create code projects with the correct directory structure. You deploy all functions in a function app at the same time and in the same package.

After you enable continuous deployment, access to function code in the Azure portal is configured as read-only because the source of truth resides elsewhere.

Note

The Deployment Center doesn't support enabling continuous deployment for a function app with inbound network restrictions. Instead, configure the build provider workflow directly in GitHub or Azure Pipelines. The runner or agent must be able to reach the app's deployment endpoint under the configured access restrictions. When the endpoint is private, the runner or agent also needs private DNS resolution. For Azure Pipelines, use a self-hosted agent on a connected network or a managed DevOps agent pool with networking. For GitHub Actions, use a self-hosted runner on a connected network or a GitHub-hosted runner with Azure private networking.

When your function app has inbound network restrictions, the workflow runner or agent must be able to reach the app's deployment endpoint under the configured access restrictions. When the endpoint is private, the runner or agent also needs private DNS resolution. For Azure Pipelines, use a self-hosted agent on a connected network or a managed DevOps agent pool with networking. For GitHub Actions, use a self-hosted runner on a connected network or a GitHub-hosted runner with Azure private networking.

Your CI/CD workflow must build a valid Azure Functions container image, push the image to a registry that your container app can access, and update the function app to create a revision from that image. For more information, see Create a function app on Azure Container Apps.

Select a build provider

Building your code project is part of the deployment process. The specific build process depends on your specific language stack, operating system, and hosting plan. You can build locally or remotely, depending on your hosting. For more information, see Remote build.

Important

For increased security, use a build provider that supports managed identities, such as Azure Pipelines and GitHub Actions. The App Service build service requires you to enable basic authentication and use text-based credentials.

Azure Functions supports these build providers:

Azure Pipelines

Azure Pipelines is one of the services in Azure DevOps and the default build provider for Azure Repos projects. You can also use Azure Pipelines to build projects from GitHub. In Azure Pipelines, there's an AzureFunctionApp task designed specifically for deploying to Azure Functions. This task provides you with control over how the project gets built, packaged, and deployed. Azure Pipelines supports managed identities.

GitHub Actions

The default build provider for GitHub projects is GitHub Actions. It provides you with control over how the project gets built, packaged, and deployed. This provider supports managed identities.

App Service build service

The App Service platform provides a native build and deployment service. This service supports local Git deployment, some container deployments, and other deployment sources that Azure Pipelines and GitHub Actions don't support. The deployment site dedicated to your app handles remote builds, packaging, and other maintenance tasks. The deployment endpoint uses the scm subdomain, as in https://myfunctionapp.scm.azurewebsites.net. You can use this build service only when your deployment can access the deployment endpoint. While you can use identities to connect to the deployment endpoint, many publishing tools require basic authentication instead.

On the Consumption plan, the App Service build service supports only Windows.

This build service is used when you deploy your code project by using Visual Studio, Visual Studio Code, or Azure Functions Core Tools. If you didn't already use one of these tools to deploy code to your function app, you might need to Enable basic authentication for deployments to use the deployment endpoint.

Keep the strengths and limitations of these providers in mind when you enable source control integration. You might need to change your repository source type to take advantage of a specific provider.

Use Azure Pipelines or GitHub Actions to build and deploy your project. These providers support Microsoft Entra identities and use the Flex Consumption package deployment process.

• For Azure Repos, use Azure Pipelines.
• For GitHub, use GitHub Actions.

The App Service build service doesn't apply to Flex Consumption.

Use a container build provider that can build your Azure Functions image, push it to a container registry, and update your function app to create a revision from the new image. For an end-to-end GitHub Actions workflow, see Deploy to Azure Container Apps with GitHub Actions.

Configure continuous deployment

The Azure portal provides a Deployment Center for your function apps, which makes it easier to configure continuous deployment. The specific way you configure continuous deployment depends both on the type of source control repository in which your code resides and the build provider you choose.

In the Azure portal, browse to your function app page and select Deployment Center under Deployment on the left pane.

Select the Source repository type where your project code is being maintained from one of these supported options:

Azure Repos

Define deployments from Azure Repos that use Azure Pipelines in the Azure DevOps portal. Don't define these deployments from your function app. For a step-by-step guide to creating an Azure Pipelines-based deployment from Azure Repos, see Continuous delivery with Azure Pipelines.

GitHub

Define deployments from GitHub that use Azure Pipelines in the Azure DevOps portal. Don't define these deployments from your function app. For a step-by-step guide to creating an Azure Pipelines-based deployment from GitHub, see Continuous delivery with Azure Pipelines.

Bitbucket

You can't deploy from Bitbucket by using Azure Pipelines. Instead, choose the App Service build service.

Local Git

You can't deploy from Local Git by using Azure Pipelines. Instead, choose the App Service build service.

Azure Repos

You can't deploy from Azure Repos by using GitHub Actions. Choose a different build provider.

GitHub

To add a GitHub Actions workflow to an existing function app:

1. Go to your function app in the Azure portal and select Deployment > Deployment Center.

2. Select Continuous Deployment (CI/CD). For Source, select GitHub. If you don't see the default message Building with GitHub Actions, select Change provider, choose GitHub Actions, and select OK.

3. If you didn't already authorize GitHub access, select Authorize. Provide your GitHub credentials and select Sign in. To authorize a different GitHub account, select Change Account and sign in with another account.

4. Select your GitHub Organization, Repository, and Branch. To deploy by using GitHub Actions, you must have write access to this repository.

5. For Workflow option, select Add a workflow. This option creates a new workflow file in /.github/workflows/. To use an existing workflow, select Use available workflow and choose your workflow file.

6. In Authentication settings, choose User-assigned identity to use OpenID Connect (OIDC), which is recommended because it doesn't require you to store secrets in GitHub. Select your subscription and the (New) suggested identity name. A new user-assigned managed identity is created and granted access to the Website Contributor role. If you use an existing identity, you must first grant it access to Website Contributor role.

   Important

   When you select Basic authentication, your publish profile, which contains shared secrets, is stored in GitHub Secrets. You must also enable SCM basic authentication, which makes your app less secure.

7. Select Preview file to see the workflow file that gets added to your GitHub repository in .github/workflows/.

8. Select Save to add the workflow file to your repository. Select the Logs tab to view the status of current and previous deployments.

To learn more about GitHub Actions deployments, including other ways to generate the workflow configuration file, see Continuous delivery by using GitHub Actions.

Bitbucket

You can't deploy from Bitbucket by using GitHub Actions. Instead, choose the App Service build service.

Local Git

You can't deploy from Local Git by using GitHub Actions. Instead, choose the App Service build service.

Azure Repos

1. Go to your function app in the Azure portal and select Deployment Center.

2. For Source, select Azure Repos. If App Service build service provider isn't the default, select Change provider, select App Service build service, and then select OK.

3. Select values for Organization, Project, Repository, and Branch. Only organizations that belong to your Azure account are displayed.

4. Select Save to create the webhook in your repository.

GitHub

1. Go to your function app in the Azure portal and select Deployment Center.

2. For Source, select GitHub. If App Service build service provider isn't the default, select Change provider, select App Service build service, and then select OK.

3. If your GitHub access isn't already authorized, select Authorize. Provide your GitHub credentials and select Sign in. If you need to authorize a different GitHub account, select Change Account and sign in with another account.

4. Select values for Organization, Repository, and Branch. The values are based on the location of your code.

5. Review all details and select Save. The service places a webhook in your chosen repository.

When you push a new commit to the selected branch, the service pulls your code, builds your application, and deploys it to your function app.

Bitbucket

1. Go to your function app in the Azure portal and select Deployment Center.

2. For Source, select Bitbucket.

3. If you didn't already authorize access to Bitbucket, select Authorize and then Grant access. If requested, provide your Bitbucket credentials and select Sign in. If you need to authorize a different Bitbucket account, select Change Account and sign in with another account.

4. Select values for Organization, Repository, and Branch. The values are based on the location of your code.

5. Review all details and select Save. The service places a webhook in your chosen repository.

When you push a new commit to the selected branch, the service pulls your code, builds your application, and deploys it to your function app.

Local Git

1. Go to your function app in the Azure portal and select Deployment Center.

2. For Source, select Local Git and select Save.

3. You create a local repository in your existing App Service plan, which you access from the deployment site. Copy the Git clone URI and use it to create a clone of this new repository on your local computer.

When you push a new commit to the Local Git repository, the service pulls your code, builds your application, and deploys it to your function app.

After deployment finishes, the service deploys all code from the specified source to your app. At that point, changes in the deployment source trigger a deployment of those changes to your function app in Azure.

Configure continuous deployment in your repository by using one of these providers:

• Continuous delivery with Azure Pipelines
• Continuous delivery by using GitHub Actions

Each successful workflow run deploys a new application package. Deployment Center source control integration isn't available for Flex Consumption.

Configure your CI/CD workflow to build and push the container image, and then deploy the image to your function app. Each image update creates a Container Apps revision. For more information, see Deploy to Azure Container Apps with GitHub Actions.

Enable continuous deployment during app creation

When you create a function app in the Azure portal, you can configure continuous deployment from GitHub by using GitHub Actions. Configure GitHub Actions on the Deployment tab of the Create Function App page.

To use a different deployment source or build provider for continuous integration, first create your function app. Then return to the portal and set up continuous integration in the Deployment Center.

For Azure Pipelines, first create your function app and then configure the pipeline in Azure DevOps.

Create the function app from a container image, and then configure your CI/CD workflow to publish updated images and create revisions. For more information, see Create a function app on Azure Container Apps.

Enable basic authentication for deployments

This section applies only to deployment methods that use the App Service deployment endpoint.

In some cases, your function app is created with basic authentication access to the deployment endpoint disabled. This condition blocks publishing by all methods that can't use Microsoft Entra identities to access the deployment endpoint. The publishing impacts of disabling basic authentication for the deployment endpoint are detailed in Deploy without basic authentication.

Important

When you use basic authentication, credentials are sent in clear text. To protect these credentials, you must only access the deployment endpoint over an encrypted connection (HTTPS) when using basic authentication. For more information, see Secure deployment.

To enable basic authentication for the deployment endpoint:

Azure portal

1. In the Azure portal, go to your function app.

2. On the app's left menu, select Settings > Configuration > General settings.

3. Set SCM Basic Auth Publishing Credentials to On, and then select Save.

Azure CLI

Use Azure CLI to turn on basic authentication. Run the az resource update command to update the resource that controls the deployment endpoint.

az resource update --resource-group <RESOURCE_GROUP> --name scm --namespace Microsoft.Web --resource-type basicPublishingCredentialsPolicies --parent sites/<APP_NAME> --set properties.allow=true

In this command, replace the placeholders with your resource group name and app name.

SCM basic authentication doesn't apply to Flex Consumption package deployments. By default, Azure Pipelines uses a Microsoft Entra bearer token from its required Azure service connection; workload identity federation is recommended. For GitHub Actions, use the recommended OpenID Connect (OIDC) authentication. These methods avoid SCM publishing credentials and are more secure than basic authentication.

This basic authentication setting doesn't apply to Functions on Azure Container Apps. Configure authentication between your CI/CD provider, container registry, and container app instead.

Next steps

Best practices for Azure Functions