Examkin

Question

Difficulty: MediumCreate and Configure Azure Functions

You have an existing Azure Function App (V4 runtime) that uses a standard connection string for the host storage account configuration (AzureWebJobsStorage). To comply with security policies, you must migrate the Function App to use an identity-based connection instead of connection secrets.

Which sequence of steps should you perform to configure the Function App to use a system-assigned managed identity for its host storage?

  1. 1Enable a system-assigned managed identity on the Azure Function App.
  2. 2Assign the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Table Data Contributor roles to the identity at the scope of the storage account.
  3. 3Add the AzureWebJobsStorage__accountName application setting to the Function App configuration.
  4. 4Delete the connection string value named AzureWebJobsStorage from the Function App application settings.

Answer

To configure the Function App to use a system-assigned managed identity for host storage, first enable the system-assigned managed identity on the Function App. Next, assign the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Table Data Contributor roles to the managed identity. Then, add the AzureWebJobsStorage__accountName application setting to the Function App configuration. Finally, delete the connection string value named AzureWebJobsStorage from the Function App application settings.
The correct sequence begins with enabling the system-assigned managed identity to generate the service principal ID. Once the principal is created, the required Azure RBAC roles must be assigned to grant the identity access to the storage account. The configuration settings must then be updated by adding the AzureWebJobsStorage__accountName setting to specify the target storage account name. Finally, the legacy AzureWebJobsStorage connection string setting must be deleted, as connection string settings take precedence over identity-based configurations.

Step-by-Step Solution

1
Enable a system-assigned managed identity on the Function App.
A system-assigned managed identity principal is created in Microsoft Entra ID for the Function App.
An identity principal must exist in Microsoft Entra ID before it can be assigned Azure role-based access control (RBAC) roles.
2
Assign Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Table Data Contributor roles to the managed identity.
The identity principal is granted permission to read, write, and manage blobs, queues, and tables within the storage account.
The Azure Functions host runtime requires specific permissions to coordinate executions, manage leases, and log data. These roles must be assigned before removing connection secrets to prevent runtime initialization failures.
3
Add the application setting AzureWebJobsStorage__accountName to the Function App.
The setting instructs the Functions runtime to connect to the specified storage account using the identity.
Specifying the accountName tells the host to locate the target storage account and use the default credential flow (system-assigned managed identity) to establish the connection.
4
Delete the AzureWebJobsStorage connection string setting.
The legacy connection string containing secrets is removed from the Function App.
If the legacy AzureWebJobsStorage setting is left in place, it takes precedence over the identity-based configuration, and the app will continue to use the connection string secret.

Key Concept

Configuring Azure Functions host storage with identity-based connections using system-assigned managed identity.
Estimated Time:2m 0s
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic