Error when using managed identity for AzureWebJobsStorage

Question

Error when using managed identity for AzureWebJobsStorage

Sordakis Martina 11

Hello

We are trying to deploy a functionApp by using a managed identity for AzureWebJobsStorage, as described here: https://learn.microsoft.com/en-us/azure/azure-functions/functions-identity-based-connections-tutorial

We followed the steps and set the permissions but still get the error : "Unable to find the storage account associated with the function app".
Deployment is done via an AzureDevops Pipeline (service connection has the same permissions as the managed identity)

Do you know how this can be solved?

Thanks in advance.

Martina

SnehaAgrawal-MSFT 22,721 Reputation points Moderator

2022-05-20T05:43:28.28+00:00

Thanks for reaching here! Could you please confirm if your function app and a storage account in the same region also if you have enabled the firewall for the storage account, to help you better on this.

Also you may want to know that The AzureWebJobsStorage connection is used internally for blobs and queues that enable the trigger. If it is configured to use an identity-based connection, it will need additional permissions beyond the default requirement.

These are covered by the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Account Contributor roles.
see Connecting to host storage with an identity.

Let us know.

sadomovalex 3,636

for provisioning function app ARM template should also contain storage account which will be used by this function app, e.g. like this:

  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "name": "[parameters('storageName')]",
      "apiVersion": "2019-04-01",
      "kind": "StorageV2",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard_LRS"
      },
      "properties": {
        "supportsHttpsTrafficOnly": true,
        "allowBlobPublicAccess": false,
        "minimumTlsVersion": "TLS1_2"
      }
    },

and then function app itself should depend on it:

    {
      "type": "Microsoft.Web/sites",
      "kind": "functionapp",
      "name": "[parameters('nameFromTemplate')]",
      "apiVersion": "2016-08-01",
      "location": "[parameters('location')]",
      "properties": { ... },
       ...
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageName'))]"
      ]
    },

Does your ARM template has it?

Sordakis Martina (G-IT-PN /A) 6 Reputation points

2022-05-24T11:06:30.283+00:00

Hello

Function app and storage account are in the same region. The firewall is disabled. The identity has the Storage Blob Data Owner Role assigned. Does it need all of the listed roles? We are just using the time trigger.

Thanks for your help

UPDATE: tested by assigning all the roles but still getting the same error
Sordakis Martina 11 Reputation points

2022-05-24T11:13:34.523+00:00

Hello

We are deploying via bicep and the storage account is not part of this deployment. It already exists though.
SnehaAgrawal-MSFT 22,721 Reputation points Moderator

2022-05-25T13:51:58.787+00:00

Thanks for reply! Could you check with other region storage account. Also, if you are fetching the storage keys using key vault for AzureWebJobsStorage configuration?
Sordakis Martina 11 Reputation points

2022-05-31T06:33:27.103+00:00

Already checked with storage keys using keyvault and got the same error. Different storage account didn't work either. We decided to open a ticket at Microsoft support and got the following answer:

• The way the Azure Dev Ops task works today is that we read the AzureWebStorage connection string.
• Then we create a container called azure-pipelines-deploy and copy the zip up to there.
• Then we generate a SAS token for that URL and set this for Run From Package.

This can’t work with managed identity today as the Azure Dev Ops task doesn’t run as the Function App and so won’t be able to rehydrate the Connection string for storage. So seems that it is not possible via Azure Devops :/

1 answer

Your answer

SnehaAgrawal-MSFT 22,721 Reputation points Moderator

2022-05-20T05:43:28.28+00:00

Thanks for reaching here! Could you please confirm if your function app and a storage account in the same region also if you have enabled the firewall for the storage account, to help you better on this.

Also you may want to know that The AzureWebJobsStorage connection is used internally for blobs and queues that enable the trigger. If it is configured to use an identity-based connection, it will need additional permissions beyond the default requirement.

These are covered by the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Account Contributor roles.
see Connecting to host storage with an identity.

Let us know.
sadomovalex 3,636 Reputation points

2022-05-20T14:40:59.867+00:00

for provisioning function app ARM template should also contain storage account which will be used by this function app, e.g. like this:

"resources": [ { "type": "Microsoft.Storage/storageAccounts", "name": "[parameters('storageName')]", "apiVersion": "2019-04-01", "kind": "StorageV2", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "properties": { "supportsHttpsTrafficOnly": true, "allowBlobPublicAccess": false, "minimumTlsVersion": "TLS1_2" } },

and then function app itself should depend on it:

{ "type": "Microsoft.Web/sites", "kind": "functionapp", "name": "[parameters('nameFromTemplate')]", "apiVersion": "2016-08-01", "location": "[parameters('location')]", "properties": { ... }, ... "dependsOn": [ "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageName'))]" ] },

Does your ARM template has it?
Sordakis Martina (G-IT-PN /A) 6 Reputation points

2022-05-24T11:06:30.283+00:00

Hello

Function app and storage account are in the same region. The firewall is disabled. The identity has the Storage Blob Data Owner Role assigned. Does it need all of the listed roles? We are just using the time trigger.

Thanks for your help

UPDATE: tested by assigning all the roles but still getting the same error
Sordakis Martina 11 Reputation points

2022-05-24T11:13:34.523+00:00

Hello

We are deploying via bicep and the storage account is not part of this deployment. It already exists though.
SnehaAgrawal-MSFT 22,721 Reputation points Moderator

2022-05-25T13:51:58.787+00:00

Thanks for reply! Could you check with other region storage account. Also, if you are fetching the storage keys using key vault for AzureWebJobsStorage configuration?
Sordakis Martina 11 Reputation points

2022-05-31T06:33:27.103+00:00

Already checked with storage keys using keyvault and got the same error. Different storage account didn't work either. We decided to open a ticket at Microsoft support and got the following answer:

• The way the Azure Dev Ops task works today is that we read the AzureWebStorage connection string.
• Then we create a container called azure-pipelines-deploy and copy the zip up to there.
• Then we generate a SAS token for that URL and set this for Run From Package.

This can’t work with managed identity today as the Azure Dev Ops task doesn’t run as the Function App and so won’t be able to rehydrate the Connection string for storage. So seems that it is not possible via Azure Devops :/

Answer 1

Himanshu Punjabi 10

Thank you for sharing this information Sordakis Martina. I had exactly the same requirement and was searching for a solution since a week. This post is really helpful.

Share via

Error when using managed identity for AzureWebJobsStorage

1 answer

Your answer