Managed Service Identity | Azure Function APP

Question

Hi Team,

Now as per Microsoft recommendation we need connect storage account or any other resources by managed identity.

Here while creating function app or provisioning new function app, it is having two default app settings as mentioned below like

1. AzureWebJobsStorage
2. WEBSITE_CONTENTAZUREFILECONNECTIONSTRING

And one more thing while creating storage account triggers like below
how we can you use managed identity instead of StorageConnectionString.

public void Run([BlobTrigger("samples-workitems/{name}", Connection = "StorageConnectionString")]Stream myBlob, string name, ILogger log)

{ }

StorageConnectionString Is different from AzureWebJobsStorage__accountName How to overcome for above code and here we want to use managed identity,

JFYI: As per https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob&pivots=programming-language-csharp#connecting-to-host-storage-with-an-identity this article for latest function app we can specify just storage account name for this configuration "AzureWebJobsStorage__accountName" instead of "AzureWebJobsStorage" Is there way for this setting to use managed identity for this setting: WEBSITE_CONTENTAZUREFILECONNECTIONSTRING

Thanks, Ajith

Answer 1

Hi @AJITH KUMAR RAI - Thanks for reaching out, and engaging us on the MS Q&A community.

I looked into your question and can confirm that this isn't yet a supported configuration. The limitation is on the Azure Files side which is used by Consumption and EP plans for dynamic scaling.

The following issue has more info on this matter: Managed identity support for WEBSITE_CONTENTAZUREFILECONNECTIONSTRING setting

---

Please "Accept Answer" if the answer is helpful so that others in the community may benefit from your experience.

Answer 2

Hello @AJITH KUMAR RAI

To use managed identity instead of StorageConnectionString, you can use the following code:

public void Run([BlobTrigger("samples-workitems/{name}", Connection = "AzureWebJobsStorage")] Stream myBlob, string name, ILogger log) { }

Here, you can replace the Connection parameter with the name of the app setting that contains the connection string for your storage account. You can use the app setting AzureWebJobsStorage to specify the storage account name and use managed identity to authenticate. Regarding the app setting WEBSITE_CONTENTAZUREFILECONNECTIONSTRING, you can use managed identity to authenticate by setting the value of this app setting to the connection string of your storage account that includes the ResourceId parameter.

Here is an example of how to set the value of this app setting: DefaultEndpointsProtocol=https;AccountName=;EndpointSuffix=core.windows.net;ResourceId=/subscriptions/{YOUR-SUBSCRIPTION-ID}/resourceGroups/{YOUR-RESOURCE-GROUP-NAME}/providers/Microsoft.Storage/storageAccounts/{YOUR-ACCOUNT-NAME}

I hope this helps.