Authentication Failure: ADF Function Linked Service to Azure Function App Using System-Assigned Managed Identity

Question

Authentication Failure: ADF Function Linked Service to Azure Function App Using System-Assigned Managed Identity

Gnanasoundari 45

I’m trying to connect an Azure Data Factory (ADF) pipeline to an Azure Function App using a Function Linked Service with System-Assigned Managed Identity (MI), but I’m encountering authentication errors.

Current configuration:

Function App:
Authentication enabled via Azure AD(Microsoft identity provider)
ADF Function linked service:

Configured Function App URL

Authentication method as System Assigned Managed Identity

Resource id: Application Client id of the app registration

Function key : Not provided

Error Received with System assigned managed identity as Authentication method:

with resource id and without function keys
Call to provided Azure function '

Anonymous

2025-06-09T10:21:07+00:00
Hi @Gnanasoundari

Can you share the exact error message you are receiving during authentication?

Have you verified that the Managed Identity of the Function App is enabled and assigned the required permissions?

Are there any network restrictions (such as a firewall) that might be preventing ADF from accessing the Function App?

.Has the Function App been verified to be correctly set up for Azure AD authentication

.Can you share the exact error message or log from ADF or the Function App logs when the call fails?
Gnanasoundari 45 Reputation points

2025-06-09T11:14:32.2366667+00:00
Error Received with System assigned managed identity as Authentication method:

with resource id and without function keys
Call to provided Azure function 'Function_name' failed with status-'Unauthorized' while invoking 'POST' on 'https://functionapp_name.azurewebsites.net' and message - 'Invoking Azure function failed with HttpStatusCode - Unauthorized.'

without resource id and without function keys There was an error while calling endpoint with error message - 'Failed to get MI access token. The error message is: Acquire MI token from AAD failed. ErrorCode: invalid_resource, Message: AADSTS500011: The resource principal named https://functionapp-name.azurewebsites.net was not found in the tenant named <tenant_id>. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.Acquire MI token from AAD failed. ErrorCode: invalid_resource, Message: AADSTS500011: The resource principal named https://uks-func-sadf-dev-idi.azurewebsites.net was not found in the tenant named <tenant_id>. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.
Anonymous

2025-06-10T15:11:01.48+00:00
@Gnanasoundari

Thanks for sharing the details. Based on the AADSTS500011 – Invalid Resource and Unauthorized errors, the issue seems to be with how Azure Data Factory (ADF) is authenticating against the Azure Function App that's secured with Azure AD.

Correct Resource URI in ADF Linked Service: Use the Application ID URI (found under Expose an API in your Function App's App Registration), like:https://<functionapp-name>.azurewebsites.net

The Function App's App Registration must exist in the same Azure AD tenant where ADF is running, or proper consent must be given if it's multi-tenant.

Assign the ADF System-Assigned Managed Identity the appropriate App role or permissions in the Function App (via App Registration or RBAC).

Make sure Azure AD authentication is enabled on the Function App and the function endpoint supports bearer token authentication (not expecting a function key).
Anonymous

2025-06-11T09:53:22.67+00:00

@Gnanasoundari ,

Just checking in to see if my earlier response answered your question. If you need more help or have any other questions, just let me know!
Gnanasoundari 45 Reputation points

2025-06-11T11:26:20.4666667+00:00

Is function key mandatory here? Even i didn't enter anything and saved the changes, i can see some keys are adding.
Even if i proceed, i am getting unauthorized error
Anonymous

2025-06-11T14:52:10.81+00:00
@Gnanasoundari ,

Thank you for your follow-up.

Since you are using System-Assigned Managed Identity in Azure Data Factory (ADF) to call your Azure Function App secured with Azure AD, please note the following:

When using Azure AD authentication with Managed Identity, you do not need to provide a Function Key.

The "Function Key" field may appear in the UI, but it is only relevant if you are using key-based authentication (which you are not).

You can safely leave this field blank.
Anonymous

2025-06-12T17:54:56.4933333+00:00

@Gnanasoundari

Just following up again to see if you were able to resolve the issue or if there's anything else I can assist you with.

1 answer

Your answer

Anonymous

2025-06-09T10:21:07+00:00

Hi @Gnanasoundari

Can you share the exact error message you are receiving during authentication?

Have you verified that the Managed Identity of the Function App is enabled and assigned the required permissions?

Are there any network restrictions (such as a firewall) that might be preventing ADF from accessing the Function App?

.Has the Function App been verified to be correctly set up for Azure AD authentication

.Can you share the exact error message or log from ADF or the Function App logs when the call fails?
Gnanasoundari 45 Reputation points

2025-06-09T11:14:32.2366667+00:00

Error Received with System assigned managed identity as Authentication method:

with resource id and without function keys
Call to provided Azure function 'Function_name' failed with status-'Unauthorized' while invoking 'POST' on 'https://functionapp_name.azurewebsites.net' and message - 'Invoking Azure function failed with HttpStatusCode - Unauthorized.'

without resource id and without function keys There was an error while calling endpoint with error message - 'Failed to get MI access token. The error message is: Acquire MI token from AAD failed. ErrorCode: invalid_resource, Message: AADSTS500011: The resource principal named https://functionapp-name.azurewebsites.net was not found in the tenant named <tenant_id>. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.Acquire MI token from AAD failed. ErrorCode: invalid_resource, Message: AADSTS500011: The resource principal named https://uks-func-sadf-dev-idi.azurewebsites.net was not found in the tenant named <tenant_id>. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.
Anonymous

2025-06-10T15:11:01.48+00:00

@Gnanasoundari

Thanks for sharing the details. Based on the AADSTS500011 – Invalid Resource and Unauthorized errors, the issue seems to be with how Azure Data Factory (ADF) is authenticating against the Azure Function App that's secured with Azure AD.

Correct Resource URI in ADF Linked Service: Use the Application ID URI (found under Expose an API in your Function App's App Registration), like:https://<functionapp-name>.azurewebsites.net

The Function App's App Registration must exist in the same Azure AD tenant where ADF is running, or proper consent must be given if it's multi-tenant.

Assign the ADF System-Assigned Managed Identity the appropriate App role or permissions in the Function App (via App Registration or RBAC).

Make sure Azure AD authentication is enabled on the Function App and the function endpoint supports bearer token authentication (not expecting a function key).
Anonymous

2025-06-11T09:53:22.67+00:00

@Gnanasoundari ,

Just checking in to see if my earlier response answered your question. If you need more help or have any other questions, just let me know!
Gnanasoundari 45 Reputation points

2025-06-11T11:26:20.4666667+00:00

Is function key mandatory here? Even i didn't enter anything and saved the changes, i can see some keys are adding.
Even if i proceed, i am getting unauthorized error
Anonymous

2025-06-11T14:52:10.81+00:00

@Gnanasoundari ,

Thank you for your follow-up.

Since you are using System-Assigned Managed Identity in Azure Data Factory (ADF) to call your Azure Function App secured with Azure AD, please note the following:

When using Azure AD authentication with Managed Identity, you do not need to provide a Function Key.

The "Function Key" field may appear in the UI, but it is only relevant if you are using key-based authentication (which you are not).

You can safely leave this field blank.
Anonymous

2025-06-12T17:54:56.4933333+00:00

@Gnanasoundari

Just following up again to see if you were able to resolve the issue or if there's anything else I can assist you with.

Answer 1

RithwikBojja 3,210 Microsoft External Staff Moderator

Hi @Gnanasoundari,

I have followed below approach and it is working for me:

Initially, created a function with Anonymous as below:

Later created a Data Factory resource and enabled managed identity in it:

enter image description here

Get the Application id of the Data factories managed identity from typing the data factory name in Microsoft Entra id:

enter image description here

Then get the app id :

enter image description here

Now in Function app Added Identity provider:

enter image description here

Then it gets created:

Granted the consent as below for the application of identity provider:

enter image description here

Now in Data factory, create a pipeline with Azure function action:

Then Add the new connection in settings, select System-assigned managed identity and then the client of the Identity Provider and keep the function key as blank:

enter image description here

Output:

When I click on debug, it gets succeeded:

enter image description here

If this answer was helpful, please click "Accept the answer" and mark Yes, as this can help other community members.

enter image description here

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.

RithwikBojja 3,210 Reputation points Microsoft External Staff Moderator

2025-06-18T03:54:07.5333333+00:00

Hi @Gnanasoundari, I wanted to follow up and see if the given answer was helpful. If this resolves your issue, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.
RithwikBojja 3,210 Reputation points Microsoft External Staff Moderator

2025-06-19T04:09:21.1566667+00:00

Hi @Gnanasoundari, I wanted to follow up and see if the given answer was helpful. If this resolves your issue, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

Share via

Authentication Failure: ADF Function Linked Service to Azure Function App Using System-Assigned Managed Identity

1 answer

Your answer