Examkin

Question

Difficulty: HardCreate and Configure Azure Functions

You are migrating an existing Azure Function App (V4 runtime) to use identity-based connections for its internal host storage instead of a connection string. The function app is currently configured with the `AzureWebJobsStorage` application setting. To comply with security guidelines, you must use a system-assigned managed identity to connect to the storage account. Which sequence of actions should you perform to complete this migration while minimizing application downtime and startup errors?

  1. 1Enable the system-assigned managed identity on the Function App resource.
  2. 2Grant the system-assigned managed identity the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Table Data Contributor roles on the storage account.
  3. 3Add the `AzureWebJobsStorage__accountName` setting with the storage account name to the Function App application settings.
  4. 4Delete the `AzureWebJobsStorage` connection string setting from the Function App application settings.

Answer

First, enable the system-assigned managed identity on the Function App resource. Second, grant the system-assigned managed identity the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Table Data Contributor roles on the storage account. Third, add the `AzureWebJobsStorage__accountName` setting with the storage account name to the Function App application settings. Fourth, delete the `AzureWebJobsStorage` connection string setting from the Function App application settings.
To migrate the Azure Function App host storage safely, the system-assigned managed identity must first be enabled so that its principal exists. Next, the required Azure RBAC roles must be granted to this identity on the storage account. To prevent startup failures, the new `AzureWebJobsStorage__accountName` setting is added next. Finally, deleting the `AzureWebJobsStorage` connection string setting completes the configuration transition, as the connection string takes precedence when both are present.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Function App resource.
The Function App is assigned an identity in Microsoft Entra ID, creating a service principal with a unique principal ID.
The principal ID is required to configure role-based access control (RBAC) in subsequent steps.
2
Assign the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Table Data Contributor roles to the system-assigned managed identity on the storage account.
The system-assigned managed identity is granted permission to manage blobs, queues, and tables in the target storage account.
The Azure Functions runtime uses these storage services internally for host coordination and state management, and must be authorized before the configuration switches to identity-based authentication.
3
Add the `AzureWebJobsStorage__accountName` app setting to the Function App.
The Function App is configured to locate the storage account for host storage using the identity-based connection format.
Adding this setting first ensures that there is a valid configuration target before the connection string is removed, preventing configuration gaps.
4
Remove the `AzureWebJobsStorage` application setting.
The runtime no longer detects the connection string and immediately switches to the identity-based configuration defined in the account name setting.
The connection string setting has precedence. Removing it is necessary to force the host to use the system-assigned managed identity.

Key Concept

Configuring identity-based connections for the Azure Functions host storage (`AzureWebJobsStorage`).
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic