Create Azure function app validation failed but no error

David Holden 5

I am trying to create a function app, which uses an existing storage account. I am aware that there are limitations on which storage accounts can be used but I believe storage account is suitable and it is available for selection on the storage tab.

I am using an app service plan.

The storage account has been secured with a virtual network and private endpoints (I did not set up the storage account).

On the networking tab, I am disabling public access, enabling network injection, selecting a virtual network and I have configured inbound access.

However, when I try to create the function app, it tells me validation has failed but there is no error! There is nothing in the activity logs, which makes sense since it is not actually trying to create anything because it fails on validation.

How do I find out what the validation errors?

Thanks

VenkateshDodda-MSFT 18,021 Reputation points Microsoft Employee

2023-05-25T17:12:46.3733333+00:00

@David Holden Thanks for reaching out to Microsoft Q&A, apologize for any inconvenience caused on this.

You can look at the resource groups activity logs and check the validate deployment operation you will be able to see the failed operation and click on the further drop down and see the failure message.
as shown below screenshot (In our case create deployment got failed due to update website operation got failed.)

Feel free to reach back to me if you have any further questions on this.
David Holden 5 Reputation points

2023-05-26T14:04:59.1933333+00:00

I have made progress to a degree. If I configured the function app, with an existing vnet and configured outbound access (my logic was that the function communicating with the storage account was outward traffic).

However now, I cannot access the advanced tools-which I need to set up the power shell dependencies. I receive a 403 forbidden error.

Any idea how I fix this?

Thanks
VenkateshDodda-MSFT 18,021 Reputation points Microsoft Employee

2023-05-29T06:07:14.7833333+00:00

@David Holden Thanks for your response, apologize for the delay in my response over the weekend. Vnet integration is to limit the outbound traffic of the function app.

Could you please check if there were Access restrictions configured to kudu i.e., (Advanced tool site) under Access restrictions in Networking section of your function app.

And also check whether do you have these RBAC permissions to access kudu.
David Holden 5 Reputation points

2023-05-29T08:25:24.31+00:00

I am already a contributor to that site and according to the web link you provided, that should be enough. From what I can work out it's because I have restricted the outbound access (which I need to access the pre-existing storage account).
VenkateshDodda-MSFT 18,021 Reputation points Microsoft Employee

2023-05-29T08:54:30.47+00:00

@David Holden have checked whether are there any access restrictions configured to your function app under networking?
David Holden 5 Reputation points

2023-05-29T09:03:28.0633333+00:00

I have denied public access. This is for two reasons, obviously we do not want the public to access the function app but also the storage account I want to use, has been secured with private endpoints, hence why I have allowed outbound access with a vnet.

Bearing this in mind, how do I permit access to the kudos console?
VenkateshDodda-MSFT 18,021 Reputation points Microsoft Employee

2023-05-29T09:07:41.49+00:00

@David Holden Thanks for the explanation, at this moment you can create a virtual machine in the same function app vnet and rdp to that virtual machine and connect to function kudu from the virtual machine.
VenkateshDodda-MSFT 18,021 Reputation points Microsoft Employee

2023-05-31T03:56:31.7933333+00:00

Hello @David Holden ,

Following up to see if you have a chance to check my previous response and helped. Do let us know if you have any further questions on this.

1 answer

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more