Azure Function App: Managed Identity Secure Access

Managed Identity for Azure Function App

Overview

Managed Identity allows your Azure Function App to access resources securely without storing credentials. You can use:

• System-assigned Managed Identity: Auto-created for a single Function App.
• User-assigned Managed Identity: Can be shared across multiple services.

This identity can access resources like Key Vault, Storage Accounts, or APIs.

Step 1: Enable Managed Identity

1. Go to your Function App → Identity.
2. Enable System-assigned Managed Identity or attach a User-assigned Managed Identity.
3. Save changes. Your identity is now active.

Step 2: Assign Roles

1. Navigate to the resource (e.g., Key Vault, Storage Account).
2. Go to Access Control (IAM) → Role Assignments.
3. Select the appropriate role (e.g., Key Vault Reader, Storage Blob Data Contributor).
4. Assign the Function App’s Managed Identity.

Step 3: Access Resources from Function App

Use Azure SDKs or REST APIs to authenticate via Managed Identity:

• C# Example for Key Vault:

  var client = new SecretClient(new Uri("https://your-keyvault.vault.azure.net/"), new DefaultAzureCredential());
  KeyVaultSecret secret = await client.GetSecretAsync("MySecret");
  

• Python Example for Blob Storage:

  from azure.identity import DefaultAzureCredential
  from azure.storage.blob import BlobServiceClient
  
  credential = DefaultAzureCredential()
  blob_service_client = BlobServiceClient(account_url="https://yourstorage.blob.core.windows.net", credential=credential)
  

Step 4: Combine with APIM

If your Function App is behind APIM:

• Use JWT validation to authenticate requests issued for the Managed Identity.
• Ensure the Function App identity has permissions to access required resources.

Step 5: Test & Monitor

1. Deploy the Function App with Managed Identity enabled.
2. Call the Function and verify it can access Key Vault, Storage, or other resources.
3. Check logs for authentication success or failures.

Frequently Asked Questions (FAQ)

1. Difference between system-assigned and user-assigned?

System-assigned identity is tied to a Function App and deleted with it. User-assigned can be reused across multiple resources.

2. Do I need secrets in my Function App?

No, Managed Identity eliminates storing credentials in code or configuration.

3. Can Managed Identity access resources in another subscription?

Yes, with proper role assignments on the target subscription/resource.

4. How to test Managed Identity access?

Use Azure SDK or REST API with DefaultAzureCredential and monitor logs.

5. Official Microsoft Documentation

Managed Identity Overview, Function App Identity-Based Connections