Azure Function Storage Authorization Failure

Question

Hello,

I am testing Azure Functions to execute a PowerShell script
The AZ Function performs storage operations (copy/move/delete).
The service principal is used for auth of services (AZ Function/Storage)
The Storage firewall is enabled, Az Function Public IPs are whitelisted on the storage firewall and working well with Environment-A

The Azure Function executes well in one of the Environment-A, but the problem occurs in Environment-B.
The configuration is similar and in place,

Troubleshooting:
As the Storage firewall is enabled in Environment-A and Environment-B,
We changed the Firewall to allow all networks and it worked as Environment-A,
and when selecting the option "Enabled from selected VNET and IPs" we are facing the issue as the image attached, the AZ Function IPs are whitelisted.

Thanks
Gaurav

Answer 1

Based on the error message, it seems the issue is with the authorization. I believe there is a problem in the service principal configuration, can you double check that part and post results here.

Answer 2

@Singh, Gaurav

This error message indicates that the Azure Function is not authorized to access the storage account. This could be because the Azure Function's managed identity is not granted the required permissions on the storage account.

To fix this issue, you can grant the Azure Function's managed identity the required permissions on the storage account using the Azure portal or Azure PowerShell.

1. In the Azure portal, navigate to the storage account, and click on "Access control (IAM)" in the left-hand menu.
2. Click on the "Add role assignment" button, and select the "Storage Blob Data Contributor" role from the drop-down list.
3. In the "Assign access to" field, select the Azure Function's managed identity from the drop-down list.
4. Click on the "Save" button to save the changes.

Alternatively, you can use the following Azure PowerShell cmdlets to grant the Azure Function's managed identity the required permissions on the storage account:

$storageAccount = Get-AzStorageAccount -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" $functionApp = Get-AzFunctionApp -ResourceGroupName "myresourcegroup" -Name "myfunctionapp" $roleAssignment = New-AzRoleAssignment -ObjectId $functionApp.Identity.PrincipalId -RoleDefinitionName "Storage Blob Data Contributor" -Scope $storageAccount.Id

After granting the required permissions, try accessing the storage account again from the Azure Function to see if the issue is resolved.

Please let us know if you have any more questions and we will be glad to assist you further. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.

Answer 3

@Singh, Gaurav After some research, I was able to confirm that Azure Functions uses private IPs when traversing the same region within Azure and uses Public IPs when traversing inter-region. Therefore, using Public IPs to control access will not work at this time.

Alternate solutions would be-

1. Allow all traffic via Firewall
2. Follow steps to Connect your Function App to your VNET

Hope this helps. Please let us know if you have any more questions and we will be glad to assist you further. Thank you!