posts/azure-functions-without-azurewebjobsstorage

[giscus[bot]]

posts/azure-functions-without-azurewebjobsstorage

https://www.techwatching.dev/posts/azure-functions-without-azurewebjobsstorage

[lassebenni]

Thanks!

[RA-Davies]

You can't use Managed Identity on a Y1 (Comsumption Based) App Service plan so far as I know

You can confirm you did this for something that went into production and the FunctionApp is still up and running fine now?

[TechWatching]

Consumption Based Function App supports using Managed Identity. So you can use AzureWebJobsStorage__accountName instead of the AzureWebJobsStorage connection string. But, there is a big but....

Since I wrote this article, I realized that the WEBSITE_CONTENTAZUREFILECONNECTIONSTRING setting also contains the connection string to the storage account and I learned that this one is necessary for Consumption-Based to work (maybe that's what you meant by we can't use Managed Identity). This is the reason why, I don't use what I showed in Production with Consumption-based Function Apps, because even if it works there is no point removing the secret for one setting and keeping it for another one.

In the comments of an article Microsoft published about using Managed Identity with Azure Functions, I raised this issue to make Microsoft understand that this was not satisfactory, and only half of the job was done. I received some answers but no planned date for Azure Files to support using AAD identities for SMB mounting (which is why WEBSITE_CONTENTAZUREFILECONNECTIONSTRING is needed for consumption functions apps). I also created an issue on their GitHub repository which was closed since. I saw there is a newer one here.

Honestly that's a bit disappointing. I don't know if the situation will change soon for Consumption-based Function Apps, Microsoft does not seem to really care. Yet I hope they will someday make the necessary changes to make Function Apps work without any secret in the settings. I think the article is still relevant though, not that much for Consumption-based Function Apps yet as you mentioned.

[RA-Davies]

Wow thanks @TechWatching for such a detailed breakdown!

This is a very detailed and great article too (sorry I shoiuld have started with that!)

And yes, certainly for FunctionApps on a Y1/Consumption tier, when doing all the officially documented necessaries, then adding AzureWebJobsStorage__accountName (and then removing the AzureWebJobsStorage) results in a 502 Gateway error (interestingly, using the IIS error page) followed by I think a couple of different types of 500 type errors with the App eventually being stopped by Azure.

While this is happening, the blades in Azure itself will not load, opening any properties will give "Internal Server Error" on the blades themselves -which is when I realised how fundamental this issue might be. I think you have identified that other piece of the puzzle which I don't believe is documented!

I have a project where I need to sort this so will test in detail and will vote on the GitHub issues you've started!

Thanks for the great work!

[TechWatching]

By the way, there is a workaround to that as described in this article. You can use Azure Functions without Azure Files share. There is also the Flex Consumption plan that does not have this issue but is still in preview.