Azure Function - ReadOnly Lock Question

Question

We have put ReadOnly locks in our Function Apps. Why can't I access/read the Configuration portion, App Insights, and sometimes the Azure Monitor

Answer 1

Hello,

this is by design, to prevent exposure of secrets that could be used to gain write access.
There's a closed issue on Azure Functions GitHub related to this problem and roles, but the same logic applies to any role when a ReadOnly lock is placed.

RBAC reader role does not work with Azure Functions

----------

If any reply helped solve your question, please remember to upvote and/or "Accept Answer".
It helps others facing similar issues find the solution.

Answer 2

Hi @JoelP ,

Thanks for reaching out to Q&A.

According to the below documentation, a read-only lock on a storage account prevents users from listing the account keys. This is applicable to function app as well because the configuration section of the function contains the app settings that has storage account connection string. So it is expected that the configuration page of the Function app doesnt list the app settings.

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json#considerations-before-applying-your-locks

I will work to modify the above document to include Functions as well.

Hope this helps! Feel free to reach out to me if you have any questions or concerns.

Answer 3

Should you atleast check the Function app runs under Monitor?