Function App stuck: 'Function host is not running' after successful deploy (EACCES on wwwroot)

Question

Problem summary:

Azure Functions is not deploying or running code consistently in my subscription, across two different hosting plans (Linux Consumption and Flex Consumption). Root cause appears to be a file permission error on the platform-managed filesystem.

Detailed description:

I am trying to get an Azure Function App running (Node.js 22, Functions v4) in the West US 2 region, in resource group rg-bitacora-arum (subscription b906a722-dc3d-4521-a18a-a5ee2b29b1d2). I have tried two different hosting plans and both fail, ultimately converging on the same root error.

Attempt 1 — Linux Consumption plan (func-bitacora-arum-v3, West US 2):

The app remained at 0 worker instances for over 24 hours straight, returning "503 Service Unavailable" on all requests. The portal's "Diagnose and solve problems" detector confirmed: "Function was running on 0 worker instance for more than 1420 minutes."

Attempt 2 — Linux Consumption plan, new app (func-bitacora-arum-v4, West US 2, storage account in the same region):

After deleting the previous app and creating a brand-new one, az functionapp deployment source config-zip hung indefinitely (over 7 minutes with no response) and never registered in az functionapp log deployment show (returned empty []). The app URL returned "Function host is not running." persistently.

Attempt 3 — Flex Consumption plan (func-bitacora-arum-flex, West US 2):

Switched to Flex Consumption to rule out an issue specific to Linux Consumption. The resource was created successfully, and az functionapp deployment source config-zip --build-remote true reported "Deployment was successful" on 4 separate attempts (after restarting the app, running a manual syncfunctiontriggers action — which itself returned "Bad Request" — and explicitly enabling allowSharedKeyAccess on the storage account between attempts). Despite every deployment reporting success, the app never actually starts. The "Diagnose and solve problems" detector's exception log shows the exact root cause, including the full stack trace:

[Tag=''] Process reporting unhealthy: Unhealthy. Health check entries are

{'azure.functions.script_host.lifecycle':

  {'status':'Unhealthy',

   'description':'Script host in error state: Access to the path \'/home/site/wwwroot/host.json\' is denied.',

   'errorCode':'Faulted'}}

Worker failed to load package.json: EACCES: permission denied, open '/home/site/wwwroot/package.json'

System.UnauthorizedAccessException : Access to the path '/home/site/wwwroot/host.json' is denied.

 ---> System.IO.IOException : Permission denied

   at Interop.ThrowExceptionForIoErrno(...)

   at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(...)

   at System.IO.StreamReader.ValidateArgsAndOpenPath(String path, Int32 bufferSize)

   at System.IO.File.ReadAllText(String path, Encoding encoding)

   at Microsoft.Azure.WebJobs.Script.Configuration.HostJsonFileConfigurationSource.HostJsonFileConfigurationProvider.LoadHostConfig(...)

   at Microsoft.Azure.WebJobs.Script.WebHost.WebJobsScriptHostService.UnsynchronizedStartHostCoreAsync(...)

This is a filesystem permission (EACCES) error on /home/site/wwwroot/, thrown by Azure's own Functions host process (Microsoft.Azure.WebJobs.Script.WebHost) when trying to read a file it had just placed there via a successful deployment — not something within my control as the app owner.

What I've already ruled out:

• Unsupported Node.js version (using Node 22, which is supported)
• Incorrect .zip package structure (verified, host.json at the package root, successfully deployed per Azure's own deployment log)
• Storage account and Function App in different regions (fixed, both in West US 2)
• Storage account shared key access disabled (explicitly set allowSharedKeyAccess to true, issue persisted)
• Subscription state (az account show confirms "state": "Enabled")
• A specific hosting plan (fails on both Linux Consumption and Flex Consumption)
• Function/host key authentication issues (the function uses authLevel: anonymous)

What I need:

Please have an engineer check, from the platform backend, why /home/site/wwwroot/ on my Function App instances is denying read access (EACCES) to the Functions host process itself immediately after a successful deployment. This looks like a broken file share mount or storage permission issue specific to my subscription or to provisioning in the West US 2 region. I have reproduced this across 3 different Function Apps and 2 different hosting plans, with multiple "successful" deployments that still result in "Function host is not running."

Affected resources:

[PII Removed]