Understanding how an azure function storage account works and securing it

Question

I need to secure a storage account that some of the functions from the project I work on share. Only these function should have access to the storage account. All of the functions are already part of a VNET, so securing it by only allowing access from the VNET should be really easy.

What is blurry in my mind is about why and what is stored in the storage account considering that all my functions are are using a common standard app service plan.

The docs mention that in case of consumption or premium plan, the storage account is used to store the function code and binding configuration files.
https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations. However, it is not my case because I am using a dedicated plan.

I noticed I don't quite understand how an azure function storage account works while trying to test if the storage account is secure after configuring the VNET configuration. If I try to open something from the storage account from azure portal, I can't, and this is expected. As long as my IP is not included to have access. However, If I place a function outside the VNET and restart it, it will still run. Here, I would expect it to break. Also, if I delete the storage account, the function still works and I don't get it, why? AzureWebJobsStorage is correctly set and links the function to the correct storage account.

All in all my questions are:

1. What part of a storage account and why is used in case of an azure function that run on a dedicated service plan?
2. Why the function still runs even if it does not have access to the azure storage account or if I delete the storage account?

Answer 1

Hi @BeniaminMuresan-5169 ,

Functions relies on Azure Storage for operations such as managing triggers and logging function executions. For example, in case of timer trigger function, it stores information about last execution time along with other meta information and synchronization related information.

The Azure blob storage is used to maintain state and function keys.
The Table storage in storage account is used to store metrices related to function execution along with other information.
You can connect to the function app's storage account using Azure storage explorer to check these details to get an idea.

Therefore, it is possible that your functions might continue to execute (especially http trigger function) even when you disconnect the storage account. However, for smooth functioning of the app and for it to be triggered correctly, it is required to have a general-purpose Azure Storage account that supports Blob, Queue, and Table storage.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.