Cannot run FunctionApp from Azure portal

Question

Cannot run FunctionApp from Azure portal

Visan, Nicolae 36

Hello,

One of my colleagues cannot run the FunctionApp from Azure portal. Both of us have the permissions on that resource group, the only difference is that he has Contributor role and I have Owner role.

That yellow box is showing for him.

User's image

It's also weird because until last week was working also for him to run the function.

What we can do in this case?

Thanks!

Visan, Nicolae 36

This is the only change from last week:

I created a custom role which was assigned for the same person but on other resource group. Here is the JSON for that custom role:

{
    "id": "/subscriptions/***/providers/Microsoft.Authorization/roleDefinitions/b12860ab-c503-f709-4b31-d78e8616c8e7",
    "properties": {
        "roleName": "Contributor-limited",
        "description": "This is a custom role with Contributor permissions without the Storage Container write permission",
        "assignableScopes": [
            "/subscriptions/***"
        ],
        "permissions": [
            {
                "actions": [
                    "*"
                ],
                "notActions": [
                    "Microsoft.Authorization/*/Delete",
                    "Microsoft.Authorization/*/Write",
                    "Microsoft.Authorization/elevateAccess/Action",
                    "Microsoft.Blueprint/blueprintAssignments/write",
                    "Microsoft.Blueprint/blueprintAssignments/delete",
                    "Microsoft.Compute/galleries/share/action"
                ],
                "dataActions": [
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
                ],
                "notDataActions": [
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete"
                ]
            }
        ]
    }
}

So the person has Contributor role on RG1 where he cannot run the function. (the function is part of RG1).

The same person has this custom role ( Contributor role without Storage Containers access), on RG2.

Both RGs are in the same Azure Subscription.

1 answer

Your answer

Visan, Nicolae 36 Reputation points

2023-06-26T13:39:26.2866667+00:00

This is the only change from last week:

I created a custom role which was assigned for the same person but on other resource group. Here is the JSON for that custom role:

{ "id": "/subscriptions/***/providers/Microsoft.Authorization/roleDefinitions/b12860ab-c503-f709-4b31-d78e8616c8e7", "properties": { "roleName": "Contributor-limited", "description": "This is a custom role with Contributor permissions without the Storage Container write permission", "assignableScopes": [ "/subscriptions/***" ], "permissions": [ { "actions": [ "*" ], "notActions": [ "Microsoft.Authorization/*/Delete", "Microsoft.Authorization/*/Write", "Microsoft.Authorization/elevateAccess/Action", "Microsoft.Blueprint/blueprintAssignments/write", "Microsoft.Blueprint/blueprintAssignments/delete", "Microsoft.Compute/galleries/share/action" ], "dataActions": [ "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read" ], "notDataActions": [ "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write", "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action", "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action", "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete" ] } ] } }

So the person has Contributor role on RG1 where he cannot run the function. (the function is part of RG1).

The same person has this custom role ( Contributor role without Storage Containers access), on RG2.

Both RGs are in the same Azure Subscription.

Answer 1

David Broggy 6,776 MVP Volunteer Moderator

Hi Visan,

Depending on the operation of the function, here are some roles I've had to apply in order to use a function:

Reference:

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

User's image

Share via

Cannot run FunctionApp from Azure portal

1 answer

Your answer