How to prevent function app keys from changing?

Question

I have set up a FunctionApp and created 2 functions inside it. After sending several requests using invocation urls my requests started to fail with message "Unauthorized for url <my-invocation-url>.

I checked in CLI and in the portal and somehow my functions URLs have changed :(
I even tried to add a new function app key, but after a few successful requests it was deleted automatically.

I did some research and I'm suspecting that me using the Consumption plan have something to do with my function urls/app keys not being static.

What is the best solution to prevent this behavior?

Big thanks to everyone in advance!

Answer 1

Hi ,

Thanks for reaching out to Microsoft Q&A.

You may be right to suspect that the Consumption plan may be causing this issue. Function App keys and URLs should remain stable, but there are a few reasons why they might be changing automatically in your case. Here's why it happens and how to prevent it:

Why Do Function App Keys Change

1. Consumption Plan Behavior
   • If you're using an Azure Consumption Plan, Function Apps can scale out and scale in dynamically. Sometimes, this results in key regenerations when instances restart or scale down. The platform may automatically remove unused or orphaned keys.
2. App Restart or Deployment
   • If you redeploy your function app, it may regenerate keys. If you delete and recreate a function, new URLs and keys may be generated.

Key Expiry or Automatic Cleanup

• Certain keys may be deleted by Azure if they're not used for a while or if there are policy settings applied.

Solutions to Prevent Keys from Changing

Option 1: Use an App Service Plan Instead of Consumption Plan

• Switch to a Premium (EP) Plan or Dedicated (App Service Plan) where instances are always warm. This prevents function keys from changing due to scale-in/out events.

Option 2: Use a Static Key from Azure Key Vault

• Store and manage your keys securely in Key Vault instead of relying on Function App keys.
• Update your function app to fetch the key dynamically from Key Vault.

Option 3: Manually Regenerate and Store Keys

• If you want to keep the same function key, manually regenerate it via the portal or CLI. Store the key in Azure App Configuration, an environment variable, or a configuration file.

  az functionapp keys set --name <FunctionAppName> --resource-group <ResourceGroupName> --key-name <CustomKeyName> --key-value <YourKeyValue>

Option 4: Use AAD Authentication Instead of Function Keys

• Instead of relying on function keys, consider AAD Authentication (MI or OAuth Tokens) for secure access. This eliminates the need to manage and persist function keys manually.

Overall...

• If you must use a Consumption Plan, store your function key in Key Vault and retrieve it dynamically.
• If you need static keys, move to a Premium or Dedicated App Service Plan.
• For security and better access management, use Azure AD authentication.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.