Azure Function authLevel security in and out of API Management

Question

I have an APIM developer portal that contains Azure Functions as authLevel "anonymous" but they cannot be called without an access token provided by B2C. This also means that the only form of defense for these Azure Functions from outside users is the access token. The Azure Functions in the context of API Management service, however, are protected by not only the access token but also the subscription keys the APIs are associated with.I was wondering if changing the Azure Function's authLevel to "function" would not only provide the individual Azure Functions with security, but also if API management automatically updates to provide a function key if the authLevels for the functions are changed. I do not want the users to provide the function key, but rather it automatically passed through the developer portal/API management's backend.

Answer 1

hawthorne23 Thanks for posting your question in Microsoft Q&A. From the description above, you have Azure Functions with "Easy Auth" enabled to validate AD tokens, authorization level as anonymous and placed API Management in the front. Now, you are looking to see if you can change authorization level to Function and explore option to automatically update the function key if it gets changed.

Here are the few things I would like to start with:

1. While importing a Function app in API Management, a host key will be generated in the Function app and a named value in APIM with the generated host key as described in Authorization. This function key will be passed for all requests from APIM to Azure Function and hence users don't need to pass this when calling APIM. This is an easy way to set up Azure Functions with APIM. You can also create a named value manually in APIM with function key and update APIM policies (such as set-query-parameter) to send this key for all the requests.
2. However, there is no built-in support for automatically update the named value when host key in the function is changed. So, whenever you change the function key, set up a process to update the named value as needed (which could be ARM template like this discussion, CLI, Rest API etc.), .
3. If you like Azure Functions to receive calls only through APIM, you can also consider applying IP security i.e. APIM outbound IP (or IP ranges in case of Consumption tier) should be added to Function Inbound rules.

I hope this helps and let me know if you have any questions.

---

If you found the answer to your question helpful, please take a moment to mark it as Yes for others to benefit from your experience. Or simply add a comment tagging me and would be happy to answer your questions.