Function App cannot start blob trigger

Question

Hi, we have a function app which uses a Blob Trigger. We have created a blob trigger function in our subscription, but we cannot get the function to work.  We examined the storage account logs and can confirm that a blob upload to the storage account does result in a PutBlob event being logged (my understanding is that it is this event that should result in the blob trigger firing.

Answer 1

Hello @Donald Christine,

Check below steps:

1. Add the connection string is to AzureWebJobStorage app setting and use it in the function code.

local.settings.json:

{

  "IsEncrypted": false,

  "Values": {

    "AzureWebJobsStorage": "<Storage_account_Connection_String>",

    "FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated"

  }

}

[Function(nameof(Function1))]

public async Task Run([BlobTrigger("blobname/{name}", Connection = "AzureWebJobsStorage")] Stream stream, string name)

{

    using var blobStreamReader = new StreamReader(stream);

    var content = await blobStreamReader.ReadToEndAsync();

    _logger.LogInformation($"C# Blob trigger function Processed blob\n Name: {name} \n Data: {content}");

}

2. Confirm that the function app has proper permissions to access the storage account.
3. Check the LogStream for the error details.

unhandled exception is encountered (403 No Access) and then the Host shuts down.

This error occurs when you don't have the proper permissions or when incorrect authentication is used to access the Storage account.

• To resolve the 403 forbidden error locally, go to storage account => Access control(IAM) => Add role assignment => Assign Storage Blob Data Owner(or) Storage Blob Data Contributor role to user account.
• If you have enabled managed identity in function App, go to storage account => Access control(IAM) => Add role assignment =>assign Storage Blob Data Contributor to Function App's managed identity.
• If you have enabled network access from Virtual Network and Ip addresses, add your client IP address to allow a firewall address under Storage account=>Networking.

• If you are using a shared access signature (SAS) token, make sure the token is not expired.

Refer MSDOC for detailed information about the 403 authentication-and-authorization-issues.

Update:

Michael Burgstaller Thank you for your patience and for sharing your feedback on the Q&A community platform. I’m glad to hear that you were able to resolve your issue, and I appreciate you sharing your solution! Your contribution is valuable and can help others in the community facing similar challenges.

As per the Microsoft Q&A community policy, "The question author cannot accept their own answer. They can only accept answers by others"

I’m reposting your solution here so you can mark it as accepted:

The issue is resolved by configuring the storage account with a private endpoint for the Storage.Queue

If you have any other questions, please let me know. Thank you again for your time and patience throughout this issue.  

Please don’t forget to Accept Answer and Yes for "was this answer helpful" wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Hi Pravallika Kothaveeranna Gari - We resolved the issue yesterday. We had to configure the storage account with a private endpoint for the Storage.Queue. We're assuming that the storage account uses the queue to deliver the PutBlob event to the function. Thanks for all of the assistance.