You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-functions/durable/durable-functions-configure-managed-identity.md
+72-49Lines changed: 72 additions & 49 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,36 +1,58 @@
1
1
---
2
-
title: "Configure Durable Functions with managed identity"
3
-
description: Configure Durable Functions with managed identity
2
+
title: "Configure Durable Functions app with managed identity"
3
+
description: Configure Durable Functions app with managed identity
4
4
author: naiyuantian
5
5
ms.topic: quickstart
6
6
ms.date: 07/30/2024
7
7
ms.author: azfuncdf
8
8
---
9
9
10
-
# Configure Durable Functions with managed identity
10
+
# Quickstart: Configure Durable Functions with managed identity
11
+
12
+
A managed identity from the access management service [Microsoft Entra ID](../../active-directory/fundamentals/active-directory-whatis.md) allows your app to access other Microsoft Entra protected resources, such as an Azure Storage account, without handling secrets manually. The identity is managed by the Azure platform, so you do *not* need to provision or rotate any secrets. The recommended way to authenticate access to Azure resources is through using such an identity.
13
+
14
+
In this quickstart, you complete steps to configure a Durable Functions app using the default **Azure Storage provider** to use identity-based connections for storage account access.
15
+
16
+
> [NOTE]
17
+
> Managed identity is supported in [Durable Functions extension](https://www.nuget.org/packages/Microsoft.Azure.WebJobs.Extensions.DurableTask) versions **2.7.0** and greater.
18
+
19
+
If you don't have an Azure account, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
20
+
21
+
## Prerequisites
22
+
23
+
To complete this quickstart, you need:
24
+
25
+
- An existing Durable Functions project created in the Azure portal or a local Durable Functions project deployed to Azure.
26
+
- Familiarity running a Durable Functions app in Azure.
27
+
28
+
If you don't have an existing Durable Functions project deployed in Azure, we recommend that you start with one of the following quickstarts:
29
+
30
+
-[Create your first durable function - C#](durable-functions-create-first-csharp.md)
31
+
-[Create your first durable function - JavaScript](quickstart-js-vscode.md)
32
+
-[Create your first durable function - Python](quickstart-python-vscode.md)
33
+
-[Create your first durable function - PowerShell](quickstart-powershell-vscode.md)
34
+
-[Create your first durable function - Java](quickstart-java.md)
11
35
12
-
A managed identity from the access management service [Microsoft Entra ID](../../active-directory/fundamentals/active-directory-whatis.md) allows your app to access other Microsoft Entra protected resources without handling secrets manually. The identity is managed by the Azure platform, so you do *not* need to provision or rotate any secrets. The recommended way to authenticate access to Azure resources is through using such an identity. In this article, we show how to configure a Durable Functions app that is using the default Azure Storage provider to use a managed identity to access the storage account.
13
36
14
37
## Local development
15
38
16
39
### Use Azure Storage emulator
17
-
When developing locally, it's recommended that you use Azurite, which is Azure Storage's local emulator. You can configure your app to the emulator by specifying `"AzureWebJobsStorage": "UseDevelopmentStorage = true"` in the local.settings.json.
40
+
When developing locally, it's recommended that you use Azurite, which is Azure Storage's local emulator. Configure your app to the emulator by specifying `"AzureWebJobsStorage": "UseDevelopmentStorage = true"` in the local.settings.json.
18
41
19
42
### Identity-based connections for local development
43
+
You can use an identity-based connection for local development if you prefer. Strictly speaking, a managed identity is only available to apps when executing on Azure. When configured to use identity-based connections, a locally executing app will utilize your developer credentials to authenticate against Azure resources. Then, when deployed on Azure, it will utilize your managed identity configuration instead.
20
44
21
-
You can still use an identity-based connection for local development if you prefer. Strictly speaking, a managed identity is only available to apps when executing on Azure. When configured to use identity-based connections, a locally executing app will utilize your developer credentials to authenticate with Azure resources. Then, when deployed on Azure, it will utilize your managed identity configuration instead.
22
-
23
-
When using your developer credentials, the connection attempts to get a token from the following locations, in the said order, for access to your Azure resources:
45
+
When using developer credentials, the connection attempts to get a token from the following locations, in the said order, for access to your Azure resources:
24
46
25
47
- A local cache shared between Microsoft applications
26
48
- The current user context in Visual Studio
27
49
- The current user context in Visual Studio Code
28
50
- The current user context in the Azure CLI
29
51
30
-
If none of these options are successful, an error occurs.
52
+
If none of these options are successful, an error shows up regarding the app's inability to retrieve authentication token for your Azure resources.
31
53
32
54
#### Configure runtime to use local developer identity
33
-
1. Specify the name of your Azure Storage account in local.settings.json:
55
+
1. Specify the name of your Azure Storage account in local.settings.json, for example:
34
56
```json
35
57
{
36
58
"IsEncrypted": false,
@@ -51,77 +73,78 @@ If none of these options are successful, an error occurs.
51
73
52
74
## Identity-based connections for app deployed to Azure
53
75
54
-
Managed identity is supported in [Durable Functions extension](https://www.nuget.org/packages/Microsoft.Azure.WebJobs.Extensions.DurableTask) versions **2.7.0** and greater.
55
-
56
-
### Prerequisites
57
-
58
-
The following steps assume that you're starting with an existing Durable Functions app and are familiar with how to operate it. In particular, this quickstart assumes that you have already:
59
-
60
-
* Deployed an app running in Azure that has Durable Functions.
61
-
62
-
If this isn't the case, we suggest you start with one of the following articles, which provides detailed instructions on how to achieve all the requirements above:
63
-
64
-
-[Create your first durable function - C#](durable-functions-create-first-csharp.md)
65
-
-[Create your first durable function - JavaScript](quickstart-js-vscode.md)
66
-
-[Create your first durable function - Python](quickstart-python-vscode.md)
67
-
-[Create your first durable function - PowerShell](quickstart-powershell-vscode.md)
68
-
-[Create your first durable function - Java](quickstart-java.md)
69
-
70
76
### Enable managed identity resource
71
77
72
-
Only one identity is needed for your function, either a **systemassigned managed identity** or a **userassigned managed identity**. To enable a managed identity for your function application and learn more about the differences between the two identities, read the [detailed instructions](../../app-service/overview-managed-identity.md).
78
+
To begin, enable a managed identity for your application. Your function app must have either a system-assigned managed identity or a user-assigned managed identity. To enable a managed identity for your function app, and to learn more about the differences between the two types of identities, see the [managed identity overview](../../app-service/overview-managed-identity.md).
73
79
74
-
### Assign Role-based Access Controls (RBAC) to managed identity
80
+
### Assign access roles to the managed identity
75
81
76
-
Navigate to your app's Azure Storage resource on the Azure portal and [assign the following roles](/entra/identity/managed-identities-azure-resources/how-to-assign-access-azure-resource) to your managed identity resource:
82
+
Navigate to your app's Azure Storage resource on the Azure portal and [assign](/entra/identity/managed-identities-azure-resources/how-to-assign-access-azure-resource) three role-based access control (RBAC) roles to your managed identity resource:
77
83
78
84
* Storage Queue Data Contributor
79
85
* Storage Blob Data Contributor
80
86
* Storage Table Data Contributor
81
87
82
-
You'll need to select assign access to "Managed identity" and then "+ Select members" to find your identity resource:
88
+
To find your identity resource, select assign access to **Managed identity** and then **+ Select members**
83
89
84
90
85
91
86
92
### Add managed identity configuration to your app
87
93
88
-
Navigate to your Azure Functions app’s **Configuration** page and perform the following changes:
94
+
Before you can use your app's managed identity, make some changes to the app configuration:
89
95
90
-
1.Remove the default value "AzureWebJobsStorage".
96
+
1.In the Azure portal, on your function app resource menu under **Settings**, select **Configuration**.
91
97
98
+
1. In the list of settings, select **AzureWebJobsStorage** and select the **Delete** icon.
92
99
[](./media/durable-functions-configure-df-with-credentials/durable-functions-managed-identity-scenario-01.png#lightbox)
93
100
94
-
2. Link your Azure Storage account by adding **either one** of the following value settings (remember to click "Apply" after making the setting changes):
101
+
1. Add a setting to link your Azure storage account to the application.
102
+
103
+
Use *one of the following methods* depending on the cloud that your app runs in:
104
+
105
+
-**Azure cloud**: If your app runs in *public Azure*, add a setting that identifies an Azure storage account name:
95
106
96
-
* Option 1:
97
-
**AzureWebJobsStorage__accountName**: For example: `mystorageaccount123`
-**Non-Azure cloud**: If your application runs in a cloud outside of Azure, you must add a specific service URI (*an endpoint*) for the storage account instead of an account name.
> If you are using [Azure Government](../../azure-government/documentation-government-welcome.md) or any other cloud that's separate from public Azure, you must use the option to provide a specific service URL. For more information on using Azure Storage with Azure Government, see the [Develop by using the Storage API in Azure Government](../../azure-government/documentation-government-get-started-connect-to-storage.md).
105
115
106
-
> [!NOTE]
107
-
> If you are using [Azure Government](../../azure-government/documentation-government-welcome.md) or any other cloud that's separate from global Azure, then you will need to use this second option to provide specific service URLs. The values for these settings can be found in the storage account under the **Endpoints** tab. For more information on using Azure Storage with Azure Government, see the [Develop with Storage API on Azure Government](../../azure-government/documentation-government-get-started-connect-to-storage.md) documentation.
0 commit comments