Merge pull request #233242 from mattchenderson/funcstorage

adding additional storage configurations to Functions provisioning

Author: v-dirichards

articles/azure-functions/create-first-function-cli-java.md

@@ -192,6 +192,8 @@ A function app and related resources are created in Azure when you first deploy
     
     The deployment packages the project files and deploys them to the new function app using [zip deployment](functions-deployment-technologies.md#zip-deploy). The code runs from the deployment package in Azure.
 
+[!INCLUDE [functions-storage-access-note](../../includes/functions-storage-access-note.md)]
+
 [!INCLUDE [functions-run-remote-azure-cli](../../includes/functions-run-remote-azure-cli.md)]
 
 [!INCLUDE [functions-streaming-logs-cli-qs](../../includes/functions-streaming-logs-cli-qs.md)]

articles/azure-functions/functions-create-first-function-bicep.md

@@ -38,6 +38,8 @@ The following four Azure resources are created by this Bicep file:
 + [**Microsoft.Web/sites**](/azure/templates/microsoft.web/sites): create a function app.
 + [**microsoft.insights/components**](/azure/templates/microsoft.insights/components): create an Application Insights instance for monitoring.
 
+[!INCLUDE [functions-storage-access-note](../../includes/functions-storage-access-note.md)]
+
 ## Deploy the Bicep file
 
 1. Save the Bicep file as **main.bicep** to your local computer.

articles/azure-functions/functions-create-first-function-resource-manager.md

@@ -40,6 +40,9 @@ The following four Azure resources are created by this template:
 + [**Microsoft.Web/sites**](/azure/templates/microsoft.web/sites): create a function app.
 + [**microsoft.insights/components**](/azure/templates/microsoft.insights/components): create an Application Insights instance for monitoring.
 
+
+[!INCLUDE [functions-storage-access-note](../../includes/functions-storage-access-note.md)]
+
 ## Deploy the template
 
 The following scripts are designed for and tested in [Azure Cloud Shell](../cloud-shell/overview.md). Choose **Try It** to open a Cloud Shell instance right in your browser. 

articles/azure-functions/functions-deployment-technologies.md

@@ -20,7 +20,7 @@ The following table describes the available deployment methods for your Function
 | -- | -- | -- |
 | Tools-based |	&bull;&nbsp;[Visual&nbsp;Studio&nbsp;Code&nbsp;publish](functions-develop-vs-code.md#publish-to-azure)<br/>&bull;&nbsp;[Visual Studio publish](functions-develop-vs.md#publish-to-azure)<br/>&bull;&nbsp;[Core Tools publish](functions-run-local.md#publish) | Deployments during development and other ad hoc deployments. Deployments are managed locally by the tooling. |
 | App Service-managed| &bull;&nbsp;[Deployment&nbsp;Center&nbsp;(CI/CD)](functions-continuous-deployment.md)<br/>&bull;&nbsp;[Container&nbsp;deployments](functions-create-function-linux-custom-image.md#enable-continuous-deployment-to-azure) |  Continuous deployment (CI/CD) from source control or from a container registry. Deployments are managed by the App Service platform (Kudu).|
-| External pipelines|&bull;&nbsp;[Azure Pipelines](functions-how-to-azure-devops.md)<br/>&bull;&nbsp;[GitHub Actions](functions-how-to-github-actions.md) | Production and DevOps pipelines that include additional validation, testing, and other actions be run as part of an automated deployment. Deployments are managed by the pipeline. |
+| External pipelines|&bull;&nbsp;[Azure Pipelines](functions-how-to-azure-devops.md)<br/>&bull;&nbsp;[GitHub Actions](functions-how-to-github-actions.md) | Production and Azure pipelines that include additional validation, testing, and other actions be run as part of an automated deployment. Deployments are managed by the pipeline. |
 
 While specific Functions deployments use the best technology based on their context, most deployment methods are based on [zip deployment](#zip-deploy).
 
@@ -95,6 +95,12 @@ Linux function apps running in the Consumption plan don't have an SCM/Kudu site,
 
 Function apps running on Linux in the [Dedicated (App Service) plan](dedicated-plan.md) and the [Premium plan](functions-premium-plan.md) also have a limited SCM/Kudu site.
 
+### App content storage
+
+Several deployment methods store the deployed or built application payload on the storage account associated with the function app. The Azure Files content share is generally used if configured, but some methods will instead store the payload in the blob store associated with the `AzureWebJobsStorage` connection. See the details in the "Where app content is stored" paragraphs of each deployment technology covered in the next section.
+
+[!INCLUDE [functions-storage-access-note](../../includes/functions-storage-access-note.md)]
+
 ## Deployment technology details
 
 The following deployment methods are available in Azure Functions.
@@ -109,6 +115,8 @@ You can use an external package URL to reference a remote package (.zip) file th
 
 >__When to use it:__ External package URL is the only supported deployment method for Azure Functions running on Linux in the Consumption plan, if the user doesn't want a [remote build](#remote-build) to occur. When you update the package file that a function app references, you must [manually sync triggers](#trigger-syncing) to tell Azure that your application has changed. When you change the contents of the package file and not the URL itself, you must also restart your function app manually.
 
+>__Where app content is stored:__ App content is stored at the URL specified. This could be on Azure Blobs, possibly in the storage account specified by the `AzureWebJobsStorage` connection. Some client tools may default to deploying to a blob in this account. For example, for Linux Consumption apps, the Azure CLI will attempt to deploy through a package stored in a blob on the account specified by `AzureWebJobsStorage`.
+
 ### Zip deploy
 
 Use zip deploy to push a .zip file that contains your function app to Azure. Optionally, you can set your app to start [running from package](run-functions-from-deployment-package.md), or specify that a [remote build](#remote-build) occurs.
@@ -119,6 +127,8 @@ Use zip deploy to push a .zip file that contains your function app to Azure. Opt
 
 >__When to use it:__ Zip deploy is the recommended deployment technology for Azure Functions.
 
+>__Where app content is stored:__ App content from a zip deploy by default is stored on the file system, which may be backed by Azure Files from the storage account specified when the function app was created. In Linux Consumption, the app content instead is persisted on a blob in the storage account specified by the `AzureWebJobsStorage` connection.
+
 ### Docker container
 
 You can deploy a Linux container image that contains your function app.
@@ -132,6 +142,8 @@ You can deploy a Linux container image that contains your function app.
 
 >__When to use it:__ Use the Docker container option when you need more control over the Linux environment where your function app runs. This deployment mechanism is available only for Functions running on Linux.
 
+>__Where app content is stored:__ App content is stored in the specified container registry as a part of the image.
+
 ### Web Deploy (MSDeploy)
 
 Web Deploy packages and deploys your Windows applications to any IIS server, including your function apps running on Windows in Azure.
@@ -142,6 +154,8 @@ Web Deploy packages and deploys your Windows applications to any IIS server, inc
 
 >__When to use it:__ Web Deploy is supported and has no issues, but the preferred mechanism is [zip deploy with Run From Package enabled](#zip-deploy). To learn more, see the [Visual Studio development guide](functions-develop-vs.md#publish-to-azure).
 
+>__Where app content is stored:__ App content is stored on the file system, which may be backed by Azure Files from the storage account specified when the function app was created.
+
 ### Source control
 
 Use source control to connect your function app to a Git repository. An update to code in that repository triggers deployment. For more information, see the [Kudu Wiki](https://github.com/projectkudu/kudu/wiki/VSTS-vs-Kudu-deployments).
@@ -150,6 +164,8 @@ Use source control to connect your function app to a Git repository. An update t
 
 >__When to use it:__ Using source control is the best practice for teams that collaborate on their function apps. Source control is a good deployment option that enables more sophisticated deployment pipelines.
 
+>__Where app content is stored:__ The app content is in the source control system, but a locally cloned and built app content from is stored on the app file system, which may be backed by Azure Files from the storage account specified when the function app was created.
+
 ### Local Git
 
 You can use local Git to push code from your local machine to Azure Functions by using Git.
@@ -158,6 +174,8 @@ You can use local Git to push code from your local machine to Azure Functions by
 
 >__When to use it:__ In general, we recommend that you use a different deployment method. When you publish from local Git, you must [manually sync triggers](#trigger-syncing).
 
+>__Where app content is stored:__ App content is stored on the file system, which may be backed by Azure Files from the storage account specified when the function app was created.
+
 ### Cloud sync
 
 Use cloud sync to sync your content from Dropbox and OneDrive to Azure Functions.
@@ -166,6 +184,8 @@ Use cloud sync to sync your content from Dropbox and OneDrive to Azure Functions
 
 >__When to use it:__ In general, we recommend other deployment methods. When you publish by using cloud sync, you must [manually sync triggers](#trigger-syncing).
 
+>__Where app content is stored:__ The app content is in the cloud store, but a local copy is stored on the app file system, which may be backed by Azure Files from the storage account specified when the function app was created.
+
 ### FTP
 
 You can use FTP to directly transfer files to Azure Functions.
@@ -174,6 +194,8 @@ You can use FTP to directly transfer files to Azure Functions.
 
 >__When to use it:__ In general, we recommend other deployment methods. When you publish by using FTP, you must [manually sync triggers](#trigger-syncing).
 
+>__Where app content is stored:__ App content is stored on the file system, which may be backed by Azure Files from the storage account specified when the function app was created.
+
 ### Portal editing
 
 In the portal-based editor, you can directly edit the files that are in your function app (essentially deploying every time you save your changes).
@@ -186,6 +208,8 @@ In the portal-based editor, you can directly edit the files that are in your fun
 >+ [Azure Functions Core Tools (command line)](functions-run-local.md)
 >+ [Visual Studio](functions-create-your-first-function-visual-studio.md)
 
+>__Where app content is stored:__ App content is stored on the file system, which may be backed by Azure Files from the storage account specified when the function app was created.
+
 The following table shows the operating systems and languages that support portal editing:
 
 | Language | Windows Consumption | Windows Premium | Windows Dedicated | Linux Consumption | Linux Premium | Linux Dedicated |

articles/azure-functions/functions-infrastructure-as-code.md

@@ -52,16 +52,22 @@ An Azure Functions deployment typically consists of these resources:
 
 A storage account is required for a function app. You need a general purpose account that supports blobs, tables, queues, and files. For more information, see [Azure Functions storage account requirements](storage-considerations.md#storage-account-requirements).
 
+[!INCLUDE [functions-storage-access-note](../../includes/functions-storage-access-note.md)]
+
 # [Bicep](#tab/bicep)
 
 ```bicep
-resource storageAccountName 'Microsoft.Storage/storageAccounts@2021-09-01' = {
+resource storageAccountName 'Microsoft.Storage/storageAccounts@2022-05-01' = {
   name: storageAccountName
   location: location
   kind: 'StorageV2'
   sku: {
     name: storageAccountType
   }
+  properties: {
+    supportsHttpsTrafficOnly: true
+    defaultToOAuthAuthentication: true
+  }
 }
 ```
 
@@ -71,24 +77,24 @@ resource storageAccountName 'Microsoft.Storage/storageAccounts@2021-09-01' = {
 "resources": [
   {
     "type": "Microsoft.Storage/storageAccounts",
-    "apiVersion": "2021-09-01",
+    "apiVersion": "2022-05-01",
     "name": "[parameters('storageAccountName')]",
     "location": "[parameters('location')]",
     "kind": "StorageV2",
     "sku": {
       "name": "[parameters('storageAccountType')]"
+    },
+    "properties": {
+      "supportsHttpsTrafficOnly": true,
+      "defaultToOAuthAuthentication": true
     }
   }
 ]
 ```
 
 ---
 
-You must also specify the `AzureWebJobsStorage` property as an app setting in the site configuration. If the function app doesn't use Application Insights for monitoring, it should also specify `AzureWebJobsDashboard` as an app setting.
-
-The Azure Functions runtime uses the `AzureWebJobsStorage` connection string to create internal queues.  When Application Insights isn't enabled, the runtime uses the `AzureWebJobsDashboard` connection string to log to Azure Table storage and power the **Monitor** tab in the portal.
-
-These properties are specified in the `appSettings` collection in the `siteConfig` object:
+You must also specify the `AzureWebJobsStorage` connection in the site configuration. This can be set in the `appSettings` collection in the `siteConfig` object:
 
 # [Bicep](#tab/bicep)
 
@@ -100,10 +106,6 @@ resource functionApp 'Microsoft.Web/sites@2022-03-01' = {
     siteConfig: {
       ...
       appSettings: [
-        {
-          name: 'AzureWebJobsDashboard'
-          value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccountName};AccountKey=${storageAccount.listKeys().keys[0].value}'
-        }
         {
           name: 'AzureWebJobsStorage'
           value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccountName};AccountKey=${storageAccount.listKeys().keys[0].value}'
@@ -127,10 +129,6 @@ resource functionApp 'Microsoft.Web/sites@2022-03-01' = {
       "siteConfig": {
         ...
         "appSettings": [
-          {
-            "name": "AzureWebJobsDashboard",
-            "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1}', parameters('storageAccountName'), listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2021-09-01').keys[0].value)]"
-          },
           {
             "name": "AzureWebJobsStorage",
             "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1}', parameters('storageAccountName'), listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2021-09-01').keys[0].value)]"
@@ -145,6 +143,73 @@ resource functionApp 'Microsoft.Web/sites@2022-03-01' = {
 
 ---
 
+In some hosting plan options, function apps should also have an Azure Files content share, and they will need additional app settings referencing this storage account. These are covered later in this article as a part of the hosting plan options to which this applies.
+
+#### Storage logs
+
+Because the storage account is used for important function app data, you may want to monitor for modification of that content. To do this, you need to configure Azure Monitor resource logs for Azure Storage. In the following example, a Log Analytics workspace named `myLogAnalytics` is used as the destination for these logs. This same workspace can be used for the Application Insights resource defined later.
+
+# [Bicep](#tab/bicep)
+
+```bicep
+resource blobService 'Microsoft.Storage/storageAccounts/blobServices@2021-09-01' existing = {
+  name:'default'
+  parent:storageAccountName
+}
+
+resource storageDataPlaneLogs 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
+  name: '${storageAccountName}-logs'
+  scope: blobService
+  properties: {
+    workspaceId: myLogAnalytics.id
+    logs: [
+      {
+        category: 'StorageWrite'
+        enabled: true
+      }
+    ]
+    metrics: [
+      {
+        category: 'Transaction'
+        enabled: true
+      }
+    ]
+  }
+}
+```
+
+# [JSON](#tab/json)
+
+```json
+"resources": [
+  {
+    "type": "Microsoft.Insights/diagnosticSettings",
+    "apiVersion": "2021-05-01-preview",
+    "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/default', parameters('storageAccountName'))]",
+    "name": "[parameters('storageDataPlaneLogsName')]",
+    "properties": {
+        "workspaceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('myLogAnalytics'))]",
+        "logs": [
+          {
+            "category": "StorageWrite",
+            "enabled": true
+          }
+        ],
+        "metrics": [
+          {
+            "category": "Transaction",
+            "enabled": true
+          }
+        ]
+    }
+  }
+]
+```
+
+---
+
+See [Monitoring Azure Storage](../storage/blobs/monitor-blob-storage.md) for instructions on how to work with these logs.
+
 ### Application Insights
 
 Application Insights is recommended for monitoring your function apps. The Application Insights resource is defined with the type `Microsoft.Insights/components` and the kind **web**: