You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-functions/functions-identity-based-connections-tutorial.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -256,7 +256,7 @@ Whenever your app would need to add a reference to a secret, you would just need
256
256
> [!TIP]
257
257
> The [Application Insights connection string](../azure-monitor/app/sdk-connection-string.md) and its included instrumentation key are not considered secrets and can be retrieved from App Insights using [Reader](../role-based-access-control/built-in-roles.md#reader) permissions. You do not need to move them into Key Vault, although you certainly can.
258
258
259
-
## Use managed identity for AzureWebJobsStorage (Preview)
259
+
## Use managed identity for AzureWebJobsStorage
260
260
261
261
Next you will use the system-assigned identity you configured in the previous steps for the `AzureWebJobsStorage` connection. `AzureWebJobsStorage` is used by the Functions runtime and by several triggers and bindings to coordinate between multiple running instances. It is required for your function app to operate, and like Azure Files, it is configured with a connection string by default when you create a new function app.
262
262
@@ -294,7 +294,7 @@ Similar to the steps you took before with the user-assigned identity and your ke
294
294
Next you will update your function app to use its system-assigned identity when it uses the blob service for host storage.
295
295
296
296
> [!IMPORTANT]
297
-
> The `AzureWebJobsStorage` configuration is used by some triggers and bindings, and those extensions must be able to use identity-based connections, too. Apps that use blob triggers or event hub triggers may need to update those extensions. Because no functions have been defined for this app, there isn't a concern yet. To learn more about this requirement, see [Connecting to host storage with an identity (Preview)](./functions-reference.md#connecting-to-host-storage-with-an-identity-preview).
297
+
> The `AzureWebJobsStorage` configuration is used by some triggers and bindings, and those extensions must be able to use identity-based connections, too. Apps that use blob triggers or event hub triggers may need to update those extensions. Because no functions have been defined for this app, there isn't a concern yet. To learn more about this requirement, see [Connecting to host storage with an identity](./functions-reference.md#connecting-to-host-storage-with-an-identity).
298
298
>
299
299
> Similarly, `AzureWebJobsStorage` is used for deployment artifacts when using server-side build in Linux Consumption. When you enable identity-based connections for `AzureWebJobsStorage` in Linux Consumption, you will need to deploy via [an external deployment package](run-functions-from-deployment-package.md).
Copy file name to clipboardExpand all lines: articles/azure-functions/functions-reference.md
+11-10Lines changed: 11 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,7 @@ The function.json file defines the function's trigger, bindings, and other confi
34
34
35
35
For more information, see [Azure Functions triggers and bindings concepts](functions-triggers-bindings.md).
36
36
37
-
The `bindings` property is where you configure both triggers and bindings. Each binding shares a few common settings and some settings which are specific to a particular type of binding. Every binding requires the following settings:
37
+
The `bindings` property is where you configure both triggers and bindings. Each binding shares a few common settings and some settings, which are specific to a particular type of binding. Every binding requires the following settings:
38
38
39
39
| Property | Values | Type | Comments|
40
40
|---|---|---|---|
@@ -112,7 +112,7 @@ For example, the `connection` property for an Azure Blob trigger definition migh
112
112
113
113
Some connections in Azure Functions can be configured to use an identity instead of a secret. Support depends on the extension using the connection. In some cases, a connection string may still be required in Functions even though the service to which you are connecting supports identity-based connections. For a tutorial on configuring your function apps with managed identities, see the [creating a function app with identity-based connections tutorial](./functions-identity-based-connections-tutorial.md).
114
114
115
-
Identity-based connections are supported by the following components:
115
+
The following components support identity-based connections:
116
116
117
117
| Connection source | Plans supported | Learn more |
@@ -124,7 +124,7 @@ Identity-based connections are supported by the following components:
124
124
| Azure Cosmos DB triggers and bindings | All |[Azure Cosmos DB extension version 4.0.0 or later][cosmosv4],<br/> [Extension bundle 4.0.2 or later][cosmosv4]|
125
125
| Azure SignalR triggers and bindings | All |[Azure SignalR extension version 1.7.0 or later][signalr] <br/>[Extension bundle 3.6.1 or later][signalr]|
126
126
| Durable Functions storage provider (Azure Storage) | All |[Durable Functions extension version 2.7.0 or later][durable-identity],<br/>[Extension bundle 3.3.0 or later][durable-identity]|
127
-
| Host-required storage ("AzureWebJobsStorage") - Preview | All |[Connecting to host storage with an identity](#connecting-to-host-storage-with-an-identity-preview)|
127
+
| Host-required storage ("AzureWebJobsStorage") | All |[Connecting to host storage with an identity](#connecting-to-host-storage-with-an-identity)|
You'll need to create a role assignment that provides access to Azure SignalR Service data plane REST APIs. We recommend you to use the built-in role [SignalR Service Owner](../role-based-access-control/built-in-roles.md#signalr-service-owner). Management roles like [Owner](../role-based-access-control/built-in-roles.md#owner) aren't sufficient.
167
+
168
+
You need to create a role assignment that provides access to Azure SignalR Service data plane REST APIs. We recommend you to use the built-in role [SignalR Service Owner](../role-based-access-control/built-in-roles.md#signalr-service-owner). Management roles like [Owner](../role-based-access-control/built-in-roles.md#owner) aren't sufficient.
| Token Credential |`<CONNECTION_NAME_PREFIX>__credential`| Defines how a token should be obtained for the connection. Recommended only when specifying a user-assigned identity, when it should be set to "managedidentity". This is only valid when hosted in the Azure Functions service. |
186
-
| Client ID |`<CONNECTION_NAME_PREFIX>__clientId`| When `credential` is set to "managedidentity", this property specifies the user-assigned identity to be used when obtaining a token. The property accepts a client ID corresponding to a user-assigned identity assigned to the application. If not specified, the system-assigned identity will be used. This property is used differently in [local development scenarios](#local-development-with-identity-based-connections), when `credential` should not be set. |
186
+
| Token Credential |`<CONNECTION_NAME_PREFIX>__credential`| Defines how a token should be obtained for the connection. This setting is recommended only when specifying a user-assigned identity, when it should be set to "managedidentity". This value is only valid when hosted in the Azure Functions service. |
187
+
| Client ID |`<CONNECTION_NAME_PREFIX>__clientId`| When `credential` is set to "managedidentity", this property specifies the user-assigned identity to be used when obtaining a token. The property accepts a client ID corresponding to a user-assigned identity assigned to the application. If not specified, the system-assigned identity is used. This property is used differently in [local development scenarios](#local-development-with-identity-based-connections), when `credential` should not be set. |
187
188
188
-
Additional options may be supported for a given connection type. Please refer to the documentation for the component making the connection.
189
+
Additional options may be supported for a given connection type. Refer to the documentation for the component making the connection.
189
190
190
191
##### Local development with identity-based connections
191
192
192
193
> [!NOTE]
193
194
> Local development with identity-based connections requires updated versions of the [Azure Functions Core Tools](./functions-run-local.md). You can check your currently installed version by running `func -v`. For Functions v3, use version `3.0.3904` or later. For Functions v4, use version `4.0.3904` or later.
194
195
195
-
When running locally, the above configuration tells the runtime to use your local developer identity. The connection will attempt to get a token from the following locations, in order:
196
+
When you are running your function project locally, the above configuration tells the runtime to use your local developer identity. The connection attempts to get a token from the following locations, in order:
196
197
197
198
- A local cache shared between Microsoft applications
198
199
- The current user context in Visual Studio
@@ -226,7 +227,7 @@ Here is an example of `local.settings.json` properties required for identity-bas
226
227
}
227
228
```
228
229
229
-
#### Connecting to host storage with an identity (Preview)
230
+
#### Connecting to host storage with an identity
230
231
231
232
The Azure Functions host uses the "AzureWebJobsStorage" connection for core behaviors such as coordinating singleton execution of timer triggers and default app key storage. This can be configured to leverage an identity as well.
Copy file name to clipboardExpand all lines: articles/azure-functions/storage-considerations.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -52,7 +52,7 @@ The storage account must be accessible to the function app. If you need to use a
52
52
53
53
### Storage account connection setting
54
54
55
-
By default, Functions clients will configure the AzureWebJobsStorage connection as a connection string stored in the [AzureWebJobsStorage application setting](./functions-app-settings.md#azurewebjobsstorage), but you can also [configure AzureWebJobsStorage to use an identity-based connection](functions-reference.md#connecting-to-host-storage-with-an-identity-preview) without a secret.
55
+
By default, Functions clients will configure the AzureWebJobsStorage connection as a connection string stored in the [AzureWebJobsStorage application setting](./functions-app-settings.md#azurewebjobsstorage), but you can also [configure AzureWebJobsStorage to use an identity-based connection](functions-reference.md#connecting-to-host-storage-with-an-identity) without a secret.
56
56
57
57
Function apps are configured to use Azure Files by storing a connection string in the [WEBSITE_CONTENTAZUREFILECONNECTIONSTRING application setting](./functions-app-settings.md#website_contentazurefileconnectionstring) and providing the name of the file share in the [WEBSITE_CONTENTSHARE application setting](./functions-app-settings.md#website_contentshare).
Copy file name to clipboardExpand all lines: includes/functions-blob-permissions.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,17 +6,17 @@ ms.date: 10/08/2021
6
6
ms.author: mahender
7
7
---
8
8
9
-
You will need to create a role assignment that provides access to your blob container at runtime. Management roles like [Owner](../articles/role-based-access-control/built-in-roles.md#owner)are not sufficient. The following table shows built-in roles that are recommended when using the Blob Storage extension in normal operation. Your application may require additional permissions based on the code you write.
9
+
You need to create a role assignment that provides access to your blob container at runtime. Management roles like [Owner](../articles/role-based-access-control/built-in-roles.md#owner)aren't sufficient. The following table shows built-in roles that are recommended when using the Blob Storage extension in normal operation. Your application may require further permissions based on the code you write.
| Trigger |[Storage Blob Data Owner]**and**[Storage Queue Data Contributor]<sup>1</sup><br/><br/>Additional permissions must also be granted to the AzureWebJobsStorage connection.<sup>2</sup> |
13
+
| Trigger |[Storage Blob Data Owner]**and**[Storage Queue Data Contributor]<sup>1</sup><br/><br/>Extra permissions must also be granted to the AzureWebJobsStorage connection.<sup>2</sup> |
14
14
| Input binding |[Storage Blob Data Reader]|
15
15
| Output binding |[Storage Blob Data Owner]|
16
16
17
17
<sup>1</sup> The blob trigger handles failure across multiple retries by writing [poison blobs] to a queue on the storage account specified by the connection.
18
18
19
-
<sup>2</sup> The AzureWebJobsStorage connection is used internally for blobs and queues that enable the trigger. If it is configured to use an identity-based connection, it will need additional permissions beyond the default requirement. These are covered by the [Storage Blob Data Owner], [Storage Queue Data Contributor], and [Storage Account Contributor] roles. To learn more, see [Connecting to host storage with an identity][webjobs-permissions].
19
+
<sup>2</sup> The AzureWebJobsStorage connection is used internally for blobs and queues that enable the trigger. If it's configured to use an identity-based connection, it needs extra permissions beyond the default requirement. The required permissions are covered by the [Storage Blob Data Owner], [Storage Queue Data Contributor], and [Storage Account Contributor] roles. To learn more, see [Connecting to host storage with an identity][webjobs-permissions].
20
20
21
21
[Storage Blob Data Reader]: ../articles/role-based-access-control/built-in-roles.md#storage-blob-data-reader
22
22
[Storage Blob Data Owner]: ../articles/role-based-access-control/built-in-roles.md#storage-blob-data-owner
@@ -25,4 +25,4 @@ You will need to create a role assignment that provides access to your blob cont
Copy file name to clipboardExpand all lines: includes/functions-durable-permissions.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ You'll need to create a role assignment that provides access to Azure storage at
12
12
-[Storage Queue Data Contributor]
13
13
-[Storage Table Data Contributor]
14
14
15
-
Your application may require more permissions based on the code you write. If you're using the default behavior or explicitly setting `connectionName` to "AzureWebJobsStorage", see [Connecting to host storage with an identity](../articles/azure-functions/functions-reference.md#connecting-to-host-storage-with-an-identity-preview) for other permission considerations.
15
+
Your application may require more permissions based on the code you write. If you're using the default behavior or explicitly setting `connectionName` to "AzureWebJobsStorage", see [Connecting to host storage with an identity](../articles/azure-functions/functions-reference.md#connecting-to-host-storage-with-an-identity) for other permission considerations.
16
16
17
17
[Storage Blob Data Contributor]: ../articles/role-based-access-control/built-in-roles.md#storage-blob-data-contributor
18
18
[Storage Queue Data Contributor]: ../articles/role-based-access-control/built-in-roles.md#storage-queue-data-contributor
0 commit comments