Forum Discussion

johnjohn-Peter's avatar
johnjohn-Peter
Iron Contributor
Apr 21, 2025

Azure Function managed identity is raising this error "Access Denied"

We have an Azure Function on .NET 8.0. and we enabled the managed identity of the Azure Function. Then we run those commands as per this official MS link https://learn.microsoft.com/en-us/sharepoint/dev/apis/webhooks/sharepoint-webhooks-using-azd-template#grant-the-function-app-access-to-sharepoint-online:-

Power shell command:

# This script requires the modules Microsoft.Graph.Authentication, Microsoft.Graph.Applications, Microsoft.Graph.Identity.SignIns, which can be installed with the cmdlet Install-Module below:
# Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Applications, Microsoft.Graph.Identity.SignIns -Scope CurrentUser -Repository PSGallery -Force
Connect-MgGraph -Scope "Application.Read.All", "AppRoleAssignment.ReadWrite.All"
$managedIdentityObjectId = "d3e8dc41-94f2-4b0f-82ff-ed03c363f0f8" # 'Object (principal) ID' of the managed identity
$scopeName = "Sites.Selected"
$resourceAppPrincipalObj = Get-MgServicePrincipal -Filter "displayName eq 'Office 365 SharePoint Online'" # SPO
$targetAppPrincipalAppRole = $resourceAppPrincipalObj.AppRoles | ? Value -eq $scopeName

$appRoleAssignment = @{
    "principalId" = $managedIdentityObjectId
    "resourceId"  = $resourceAppPrincipalObj.Id
    "appRoleId"   = $targetAppPrincipalAppRole.Id
}
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentityObjectId -BodyParameter $appRoleAssignment | Format-List


And this pnp command:

Connect-PnPOnline -Url "https://YOUR_SHAREPOINT_TENANT_PREFIX.sharepoint.com/sites/YOUR_SHAREPOINT_SITE_NAME" -Interactive -ClientId "YOUR_PNP_APP_CLIENT_ID"`

Grant-PnPAzureADAppSitePermission -AppId "3150363e-afbe-421f-9785-9d5404c5ae34" -DisplayName "YOUR_FUNC_APP_NAME" -Permissions Manage  


Here is the code for the Azure Function, which uses the login user credential if I am inside development machine and uses the Azure Function managed identity on the hosted app:

if (Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development")`
{
    var credential = new InteractiveBrowserCredential(); // or AzureCliCredential

    graphClient = new GraphServiceClient(credential);
}
else
{
    var credential = new DefaultAzureCredential(); // Managed Identity

    graphClient = new GraphServiceClient(credential);

    var token = await new DefaultAzureCredential().GetTokenAsync(
        new TokenRequestContext(new[] { "https://graph.microsoft.com/.default" })
    );

    _logger.LogInformation("Token acquired: " + token.Token.Substring(0, 20) + "...");
}

//Call to get the "Call Transfer Log Data" sharepoint list data`
try
{    
    var sitePath = "e**87";
    var listId = "6*`*`*`*`";
    var allItems = new List<ListItem>();

    // Initial page request with Expand = fields
    var page = await graphClient
                         .Sites[sitePath]
                         .Lists[listId]
                         .Items
                         .GetAsync(config =>
                             {
                                 config.QueryParameters.Top = 100;
                                 config.QueryParameters.Expand = new string[]{ "fields($select=*)" };
                             });

    allItems.AddRange(page?.Value ?? []);

    // code goes here...
}


Then I verified the setting, but running this command:

Get-PnPAzureADAppSitePermission -Site "<Site URL>"


I get this result:

Id : ***...-....
Roles : {Manage}
App : Microsoft.Azure.Functions – 3150363e-afbe-421f-9785-9d5404c5ae34


In the development environment, the code is working fine, while in the hosted Azure Function, the code raised an exception:

Access Denied

Any advice? It seems I use all the needed settings.

3 Replies

  • Try to address and fix the following:

     

    1. Verify Managed Identity Permissions
    2. Confirm the Scope of the Token, to match your Graoh API calls
    3. Test with Minimal Graph API Calls, to confirms whether the manage identity can access Graph API endpoints
    4. Ensure Tenant-Level Settings for SharePoint
    5. Debug Token Claims by using say jwt.ms
    6. Check for Time Sync Issues
    7. Retry Assignment Commands
    8. Check Diagnostic Logs

Resources