Azure Function App not bind correctly Identity under Deployment section

Question

Azure Function App not bind correctly Identity under Deployment section

Felipe Agrela 0

We have a container function app being deployed and we have System Assigned identity enabled on it, during the deployment we have a group with Acr Pull role and we associate that function to this group. When the deploy finish we don't have it correctly working because the dropdown list of Identity under the Deployment section is blank and not system assigned as it should be.
User's image

Ranashekar Guda 2,905 Reputation points Moderator

2025-05-27T23:16:11.48+00:00

Hello @Felipe Agrela,
It sounds like your Azure Function App with a system-assigned identity is deploying, but the identity isn’t showing up correctly under the Deployment section. First, make sure the system-assigned identity is enabled by going to your Function App in the Azure portal, then navigating to Identity > System Assigned and confirming it’s turned On.

Also, double-check that the identity has the correct role assignments, specifically, that it’s either directly assigned the AcrPull role or is part of a group that has this role at the appropriate scope (like the container registry). If you’re using an automated deployment, ensure it’s not unintentionally overwriting or skipping the identity settings. Sometimes it also takes a few minutes for identity changes to reflect in the portal, so refreshing the page may help.

Finally, review the deployment logs to see if there are any errors or warnings related to identity binding. If everything seems correct, try redeploying the app, as this can help the identity bind properly. Even if the identity dropdown appears blank, the identity might still be working, test if the app can pull from ACR to confirm.

Kindly refer below links:

Use managed identities for App Service and Azure Functions

Add a system-assigned identity

Hope this helps. Do let us know if you any further queries.
Ranashekar Guda 2,905 Reputation points Moderator

2025-05-28T18:18:50.89+00:00

Hello @Felipe Agrela,
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Ranashekar Guda 2,905 Reputation points Moderator

2025-05-29T17:58:05.7033333+00:00

Hello @Felipe Agrela,
Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Felipe Agrela 0 Reputation points

2025-05-29T18:00:55.43+00:00

Still not working

1 answer

Your answer

Ranashekar Guda 2,905 Reputation points Moderator

2025-05-27T23:16:11.48+00:00

Hello @Felipe Agrela,
It sounds like your Azure Function App with a system-assigned identity is deploying, but the identity isn’t showing up correctly under the Deployment section. First, make sure the system-assigned identity is enabled by going to your Function App in the Azure portal, then navigating to Identity > System Assigned and confirming it’s turned On.

Also, double-check that the identity has the correct role assignments, specifically, that it’s either directly assigned the AcrPull role or is part of a group that has this role at the appropriate scope (like the container registry). If you’re using an automated deployment, ensure it’s not unintentionally overwriting or skipping the identity settings. Sometimes it also takes a few minutes for identity changes to reflect in the portal, so refreshing the page may help.

Finally, review the deployment logs to see if there are any errors or warnings related to identity binding. If everything seems correct, try redeploying the app, as this can help the identity bind properly. Even if the identity dropdown appears blank, the identity might still be working, test if the app can pull from ACR to confirm.

Kindly refer below links:

Use managed identities for App Service and Azure Functions

Add a system-assigned identity

Hope this helps. Do let us know if you any further queries.
Ranashekar Guda 2,905 Reputation points Moderator

2025-05-28T18:18:50.89+00:00

Hello @Felipe Agrela,
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Ranashekar Guda 2,905 Reputation points Moderator

2025-05-29T17:58:05.7033333+00:00

Hello @Felipe Agrela,
Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Felipe Agrela 0 Reputation points

2025-05-29T18:00:55.43+00:00

Still not working

Answer 1

Hi Felipe Agrela,

Apologies for the delayed response. I’ve reviewed your issue.

This problem typically occurs when the Deployment Center UI does not correctly bind the system-assigned managed identity, even though it is enabled and has appropriate ACR permissions. Group-based role assignments (like AcrPull) often do not resolve immediately or aren't interpreted properly by the Deployment Center during deployment.

Try the Below Workaround to resolve the issue:

Use Azure CLI to Explicitly Bind Identity and Assign Role

Confirm System-Assigned Identity Is Enabled


az functionapp identity show --name gcm-investmentsrqf-dev --resource-group <RsrGrpNme>

Ensure "principalId" is returned, it confirms the identity is enabled.

Assign AcrPull Role Directly to Identity

Avoid relying on group membership, assign the AcrPull role directly:


az acr show --name <acr-name> --query id --output tsv


az role assignment create --assignee <principal-id> --role AcrPull --scope <acr-resource-id>

Explicitly Enable Managed Identity for Deployment Center

az functionapp deployment container config --name gcm-investmentsrqf-dev --resource-group <RsrGrpNme> --enable-managed-identity true

Manually Set Image and Tag in Deployment Center

Managed Identity disables automatic population of image/tag fields. Manually enter:

Image: <acr-name>.azurecr.io/<image-name>
Tag: latest or your specific tag

After completing the above steps:

Refresh the Deployment Center in the Azure Portal
Confirm the Identity is correctly shown
Restart the Function App or trigger a deployment
Monitor logs to verify that the container image is pulled successfully

For more details, please refer the following Microsoft documentation: Authenticate with ACR using managed identity, Configure container deployment (CLI), Assign roles using Azure CLI.

By following the steps above, the identity binding issue in the Deployment Center will be resolved, and your Function App should successfully pull images from Azure Container Registry.

Hope it helps!

Please do not forget to click "Accept the answer” and Yes wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or still running into more issues, let me know in the "comments" and I would be happy to help you.

Gaurav Kumar 785 Reputation points Moderator

2025-06-03T00:37:57.0066667+00:00

Hi Felipe Agrela,
We haven't heard any response from you and if you are still facing any issues, please click on comment. If the answer was helpful, please click on Accept answer and upvote it.

Share via

Azure Function App not bind correctly Identity under Deployment section

1 answer

Your answer