Azure Functions | Roles

Question

Hi

What role would you recommend to provide if I want to allow only Read Access to a Function App. This should include reading the Configurations and App Settings (Environment Variables) on the portal

Answer 1

@Abhay Chandramouli In general if you have access to the Reader role at the function app/subscription level you should be able to view details the configuration.

In case if custom role you should have the read permission on microsoft.web/sites/config/web/appsettings to view the app settings.

Answer 2

Hello @Abhay Chandramouli

To provide read access to a Function App, you can assign the "Reader" role to the user or service principal. This role allows the user to view the Function App and its settings, but does not allow them to make any changes.

To specifically allow the user to read the configurations and app settings (environment variables), you can assign the "Website Contributor" role to the user or service principal. This role allows the user to view and modify the app settings, but does not allow them to modify the Function App itself.

Please note that the "Website Contributor" role also allows the user to modify other settings related to the web app, such as connection strings and deployment credentials. If you only want to allow the user to view the app settings, you can create a custom role with the necessary permissions.

I hope this helps