Functions Runtime Secret Management Auditing\Logging.

CSS has had a number of issues where the customer has noted a change in the secrets management\authorization for their function and have not changed or rotated the secrets themselves. We've not been able to discern a pattern for why this is happening.

The latest occurrence involved a Function App using SendMessage and Twilio which started returning a HTTP 401 without any change from the customer. The customer was able to mitigate this by changing the Authorization level from anonymous to Functions.

The investigation discovered that this issue occurred at the same time your Function App was scaled down to a smaller instance size and also starting running on an updated Functions Runtime.
The old instance was on version 1.0.11027.0 and the new instance was on 1.0.11075.0.
The release notes for the updated runtime are at https://github.com/Azure/azure-webjobs-sdk-script/releases/tag/v1.0.11075
There were no changes to the secret managements\authorization feature in this release.

Talked with @fabiocav and there is potential for additional logging\instrumentation in this area to know then the secrets have been changed.

Start by reviewing the Functions Runtime secret management and authorization behavior described in the issue, then compare it with the linked v1.0.11075 release notes. Identify where additional logging or instrumentation could reveal when secrets or authorization change. Done means the relevant changes are observable enough to investigate similar customer reports.

Written by the indexing model from the issue text.