An organization is migrating an existing Azure Function App (V4 runtime) to meet security compliance guidelines that forbid storing connection strings in application settings. You must configure the Function App to use an identity-based connection for its default host storage account () using a system-assigned managed identity.
Which of the following actions must you perform? (Select TWO)
- Add an application setting named AzureWebJobsStorage__accountName and set its value to the name of the storage account.Answer
- Assign the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Table Data Contributor roles to the system-assigned managed identity on the storage account.Answer
- CAdd an application setting named and set its value to ManagedIdentity.
- DAssign only the Storage Blob Data Contributor role to the system-assigned managed identity on the storage account.
Answer
To configure the Function App to use an identity-based connection for , you must add the application setting AzureWebJobsStorage__accountName with the storage account name as its value, and assign the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Table Data Contributor roles to the system-assigned managed identity on the storage account.
The correct options are the actions to add the AzureWebJobsStorage__accountName application setting and to assign the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Table Data Contributor roles to the system-assigned managed identity. The AzureWebJobsStorage__accountName setting signals to the Azure Functions runtime that it should connect to the storage account using the managed identity. The specific RBAC roles are required because the Azure Functions host runtime needs blob owner privileges for lease management, and queue/table permissions for host execution and key management.
Step-by-Step Solution
Key Concept
Configuring identity-based connections for Azure Functions host storage