Forum Discussion

Joergson's avatar
Joergson
Copper Contributor
Mar 20, 2024

Deploy an Azure Functions from Azure DevOps, when Shared Access Key is disabled

Hello everyone,   we are currently trying to switch from accessing storage accounts via Keys to Managed Identities. The Azure Function itself can connect and runs properly. However, the deploymen...
balasubramanim's avatar
balasubramanim
Iron Contributor
Feb 12, 2025

Joergson 

Please try these steps.

1. Assign Required Roles
On Function App: Contributor, User Access Administrator
On Storage Account: Storage Blob Data Contributor, Storage Account Contributor

2. Enable Managed Identity
Go to Function App → Identity → Enable System Assigned Identity
Assign 'Storage Blob Data Contributor' to this identity on the Storage Account

3. Use Managed Identity in DevOps Pipeline
- task: AzureCLI@2
  inputs:
    azureSubscription: 'Your-Service-Connection-Name'
    scriptType: 'bash'
    scriptLocation: 'inlineScript'
    inlineScript: |
      az login --identity
      az functionapp deployment source config-zip \
        --resource-group YourResourceGroup \
        --name YourFunctionAppName \
        --src $(Build.ArtifactStagingDirectory)/YourFunction.zip

4. Check Deployment Logs
Open Kudu logs: https://<function-app>.scm.azurewebsites.net
Check LogFiles/Kudu/trace for errors

5. VNET Considerations
Ensure Azure DevOps can access storage via Private Endpoint if VNet integration is enabled.

Resources