Building an azure function v2 (python) with a managed identity (User Defined)

Question

I am following the following tutorial on Azure Functions https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-storage-blob-output?tabs=python-v2%2Cisolated-process%2Cnodejs-v4&pivots=programming-language-python

However when I try and use the managed identity that has been created in our AAD. I received the following error.

WARNING: Some http trigger urls cannot be displayed in the output window because they require an authentication token. Instead, you may copy them from the Azure Functions explorer.

Storage account connection string 'AzureWebJobsDefaultEndpointsProtocol=xxx does not exist. Make sure that it is a defined App Setting.

Managed identity user defined has been enabled on this blob storage.

Please can someone specify exactly the steps required to setup a managed identity user assigned with blob storage ?

Answer 1

You need to have a user-assigned managed identity created in your Azure Active Directory and then you assign the managed identity to your AZ function :

• Go to the Azure portal and navigate to your Function App.
• Under Settings, select Identity.
• Enable the User Assigned identity and select the managed identity you created.
• Save the changes and wait for the identity to be linked.

Then you grant the access to Azure Blob Storage :

• Navigate to your Azure Blob Storage account.
• Go to Access Control (IAM).
• Click on Add role assignment.
• Select a role like Storage Blob Data Contributor or Storage Blob Data Reader (depending on the level of access needed).
• Assign this role to the user-assigned managed identity you added to the Function App.

In your code you need to use the DefaultAzureCredential from azure.identity to authenticate with the managed identity:

   from azure.identity import DefaultAzureCredential

   from azure.storage.blob import BlobServiceClient

   # Use DefaultAzureCredential which will pick up the managed identity

   credential = DefaultAzureCredential()

   blob_service_client = BlobServiceClient(account_url="https://<your-storage-account-name>.blob.core.windows.net", credential=credential)

   # Example of creating a container client

   container_client = blob_service_client.get_container_client("<your-container-name>")

Then you need to set up the env variables :

• In the Azure portal, go to Configuration under the Settings section of your Function App.
• Ensure that AzureWebJobsStorage (used for internal storage by Functions) is configured correctly.
• For your code to access the storage with managed identity, you don’t need to set AzureWebJobsStorage with a key if your Function App isn’t dependent on it for data operations.