Edit

Azure OpenAI extension for Azure Functions

Important

The Azure OpenAI extension for Azure Functions is currently in preview.

The Azure OpenAI extension for Azure Functions implements a set of triggers and bindings that enable you to easily integrate features and behaviors of Azure OpenAI in Foundry Models into your function code executions.

Azure Functions is an event-driven compute service that provides a set of triggers and bindings to easily connect with other Azure services.

With the integration between Azure OpenAI and Functions, you can build functions that can:

Action Trigger/binding type
Use a standard text prompt for content completion Azure OpenAI text completion input binding
Respond to an assistant request to call a function Azure OpenAI assistant trigger
Create an assistant Azure OpenAI assistant create output binding
Message an assistant Azure OpenAI assistant post input binding
Get assistant history Azure OpenAI assistant query input binding
Read text embeddings Azure OpenAI embeddings input binding
Write to a vector database Azure OpenAI embeddings store output binding
Read from a vector database Azure OpenAI semantic search input binding

Install extension

The extension NuGet package you install depends on the C# mode in-process or isolated worker process you're using in your function app:

Add the Azure OpenAI extension to your project by installing the Microsoft.Azure.Functions.Worker.Extensions.OpenAI NuGet package, which you can do using the .NET CLI:

dotnet add package Microsoft.Azure.Functions.Worker.Extensions.OpenAI  --prerelease

When using a vector database for storing content, you should also install at least one of these NuGet packages:

Install bundle

You can add the preview extension by adding or replacing the following code in your host.json file, which specifically targets a preview version of the 4.x bundle that contains the OpenAI extension:

{
  "version": "2.0",
  "extensionBundle": {
    "id": "Microsoft.Azure.Functions.ExtensionBundle.Preview",
    "version": "[4.*, 5.0.0)"
  }
}

Go isn't currently supported for this feature.

Connections

To use the Azure OpenAI binding extension, you need to specify a connection to an OpenAI model definition. Set the OpenAI model connection in your bindings by using one of these approaches:

  • Use the AIConnectionName binding property (preferred for Azure OpenAI).
  • Set AZURE_OPENAI_ENDPOINT and AZURE_OPENAI_KEY in app settings (for Azure OpenAI).
  • Set only Open_API_Key in app settings (for https://api.openai.com).

The way you set the connection depends on both the model API and the authentication method, as indicated by the following table:

Authentication/Model API Azure OpenAI OpenAI (https://api.openai.com)
Managed identity connection AIConnectionName Not supported
Key Vault reference AZURE_OPENAI_ENDPOINT
AZURE_OPENAI_KEY		 Open_API_Key
App Configuration reference AZURE_OPENAI_ENDPOINT
AZURE_OPENAI_KEY		 Open_API_Key
Shared secret AZURE_OPENAI_ENDPOINT
AZURE_OPENAI_KEY		 Open_API_Key

Use managed identity-based connections and the AIConnectionName property.

When you use AIConnectionName, the value of this property setting depends on the type of connection:

  • Managed identity connection: The AIConnectionName property is a <CONNECTION_NAME_PREFIX> shared by a group of settings that together define an identity-based connection to Azure OpenAI. For more information, see Define identity connections.
  • Key Vault reference: The AIConnectionName property setting returns an Azure Key Vault reference to the location where the API key is centrally maintained. For more information, see Define Key Vault connections.
  • App Configuration reference: The AIConnectionName property setting returns an Azure App Configuration reference that returns an API key or a Key Vault reference. For more information, see Azure App Configuration in the connections article.
  • API key: The AIConnectionName property setting resolves to app settings containing the endpoint and key directly. Because shared keys can be compromised, use managed identity connections when possible. For more information, see Define connections.

To learn more about bindings connections, see Manage connections in Azure Functions.

The OpenAI bindings include an AIConnectionName property that you can use to specify the <ConnectionNamePrefix> for the group of app settings that define the connection to Azure OpenAI:

Setting name Description
<CONNECTION_NAME_PREFIX>__endpoint Sets the URI endpoint of the Azure OpenAI service. This setting is always required.
<CONNECTION_NAME_PREFIX>__clientId Sets the specific user-assigned identity to use when obtaining an access token. Requires that <CONNECTION_NAME_PREFIX>__credential is set to managedidentity. The property accepts a client ID corresponding to a user-assigned identity assigned to the application. It's invalid to specify both a Resource ID and a client ID. If you don't specify this property, the system-assigned identity is used. This property is used differently in local development scenarios, when credential shouldn't be set.
<CONNECTION_NAME_PREFIX>__credential Defines how an access token is obtained for the connection. Use managedidentity for managed identity authentication. This value is only valid when a managed identity is available in the hosting environment.
<CONNECTION_NAME_PREFIX>__managedIdentityResourceId When credential is set to managedidentity, set this property to specify the resource Identifier to use when obtaining a token. The property accepts a resource identifier corresponding to the resource ID of the user-defined managed identity. It's invalid to specify both a resource ID and a client ID. If you don't specify either, the system-assigned identity is used. This property is used differently in local development scenarios, when credential shouldn't be set.
<CONNECTION_NAME_PREFIX>__key Sets the shared secret key required to access the endpoint of the Azure OpenAI service by using key-based authentication. As a security best practice, always use Microsoft Entra ID with managed identities for authentication.

Consider these managed identity connection settings when you set the AIConnectionName property to myAzureOpenAI:

  • myAzureOpenAI__endpoint=https://contoso.openai.azure.com/
  • myAzureOpenAI__credential=managedidentity
  • myAzureOpenAI__clientId=aaaaaaaa-bbbb-cccc-1111-222222222222

At runtime, the host interprets these settings as a single myAzureOpenAI setting:

"myAzureOpenAI":
{
    "endpoint": "https://contoso.openai.azure.com/",
    "credential": "managedidentity",
    "clientId": "aaaaaaaa-bbbb-cccc-1111-222222222222"
}

When you use managed identities, make sure to add your identity to the Cognitive Services OpenAI User role.

When running locally, add these settings to the local.settings.json project file. For more information, see Local development with identity-based connections.

For more information, see Work with application settings.

Related content

  • Last updated on