How can I allow my Function App to access my Azure Storage Account ?

Question

How can I secure the Azure Storage account to allow my Function App?

I need to secure it using the Storage Account firewall settings, but not sure how to list the items or configure it properly.

Selecting the Checkbox still doesn't work.

Answer 1

To save others time that may stumble upon this, I would recommend reading this thread

https://learn.microsoft.com/en-us/answers/questions/1250699/azurefunction-returns-403-when-deploying-to-azure

I'm happy to delete this if I am proven wrong but I do not believe you can just add an exception for Function Apps.

Answer 2

Hi ,

Thanks for reaching out to Microsoft Q&A.

To allow your Azure Function App to securely access your Azure Storage Account using the Storage Account firewall settings, follow these steps precisely:

1. Network access configuration

From your screenshot, you have already selected:

"Enabled from selected virtual networks and IP addresses"

This is correct. It ensures only approved networks or resources can access the storage account.

---

2. Add your Function App under "Resource instances"

This step is crucial and often overlooked.

Steps:

Scroll to the "Resource instances" section in the Networking blade.

Resource type: Select "Function App" from the dropdown.

Instance name: After selecting the resource type, it should auto-populate with Function Apps in your subscription.

Select the appropriate Function App that needs access.

Note: The Function App must be in the same region and same subscription as the storage account, and it must have a system-assigned managed identity enabled.

---

3. Ensure the Function App has Managed Identity enabled

• Go to the Function App -> Identity (under Settings) -> Ensure System-assigned identity is set to 'On'.

---

4. Assign role to Function App (RBAC)

Even if the network rule is in place, access will fail without proper permissions.

• Go to your Storage Account -> Access control (IAM).
• Click Add role assignment.
  • Role: Storage Blob Data Contributor (or similar, based on your access needs)
  • Assign access to: Managed Identity
  • Select: Your Function App’s name

5 . Restart the function

If the Function App still cannot access:

• Check if the Function App is in the same region as the storage account.

Confirm that the Function App’s outbound IP is not blocked.

Use Azure Monitor Logs or Application Insights to trace the exact error.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.