Azure / Azure/azure-functions-host
Azure Functions failed to get permission for managed identity authentication for azure storage queue and azure storage blob via DefaultCredential
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 38
Description
#### Check for a solution in the Azure portal
Managed identity in azure function is not working for blob and queue
I have created azure function (in process with C# code) given all the permission to the storage account.
This function uses managed identity to connect to azure storage. Note, here queue trigger is working but I am talking about in c# code we are connecting Queue and blobs for data processing which is failing. (Not talking about queue or blob trigger extension)
Trying to connect via managed identity using below libraries
using Azure.Storage.Blobs;
using Azure.Storage.Queues;

Also created the required environment variable still facing below error for:
Storage blob:
Azure.RequestFailedException at Azure.Storage.Blobs.BlobRestClient+d__38.MoveNext
Azure.Storage.Blobs, Version=12.13.0.0, Culture=neutral, PublicKeyToken=92742159e12e44c8
This request is denied to perform this operation using this permission.
RequestId:313e9365-101e-0055-6b84-0cf075000000
Time:2023-11-01T05:31:49.4966383Z
Status: 403 (This request is denied to perform this operation using this permission.)
ErrorCode: AuthorizationPermissionDenied
Content:
AuthorizationPermissionDeniedThis request is denied to perform this operation using this permission.
RequestId:313e9365-101e-0055-6b84-0cf075000000
Time:2023-11-01T05:31:49.4966383Z
Headers:
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 313e9365-101e-0055-6b84-0cf075000000
x-ms-client-request-id: 79eaa29e-88fb-4766-baab-d1c75c4f7173
x-ms-version: 2021-08-06
x-ms-error-code: AuthorizationPermissionDenied
Date: Wed, 01 Nov 2023 05:31:48 GMT
Content-Length: 269
Content-Type: application/xml
Storage queue
Azure.RequestFailedException at Azure.Storage.Queues.MessagesRestClient+d__8.MoveNext
Azure.Storage.Queues, Version=12.15.0.0, Culture=neutral, PublicKeyToken=92742159e12e44c8
This request is denied to perform this operation using this permission.
RequestId:2ef07aba-a003-0050-0284-0c22ae000000
Time:2023-11-01T05:31:49.9021280Z
Status: 403 (This request is denied to perform this operation using this permission.)
ErrorCode: AuthorizationPermissionDenied
Content:
AuthorizationPermissionDeniedThis request is denied to perform this operation using this permission.
RequestId:2ef07aba-a003-0050-0284-0c22ae000000
Time:2023-11-01T05:31:49.9021280Z
Headers:
Server: Windows-Azure-Queue/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 2ef07aba-a003-0050-0284-0c22ae000000
x-ms-version: 2018-11-09
x-ms-error-code: AuthorizationPermissionDenied
Date: Wed, 01 Nov 2023 05:31:48 GMT
Content-Length: 269
Content-Type: application/xml


#### Investigative information
Please provide the following:
- Timestamp:
- Function App version: 4
- Function App name: mctstagingphone-tfa-mk3lu2p5pzq4o
- Function name(s) (as appropriate): mctstagingphone-tfa-mk3lu2p5pzq4o
- Invocation ID:
- Region:
#### Repro steps
Create a function app using managed identity library.
using Azure.Storage.Blobs;
using Azure.Storage.Queues;
and trying to access the storage queue and blob using DefaultCredential is not working

There function are queue and timer trigger functions for which I have added a separate extension and tested that extension and its working fine via queue trigger
PackageReference Include="Microsoft.Azure.WebJobs.Extensions.Storage.Queues" Version="5.1.3"
C# code is unable to get token using azure.Storage.Blobs and Azure.Storage.Queue which is the requirement to process the data as during processing we need to connect to queue and blob multiple times.
#### Expected behavior
Code should work and fetched the token using DefaultCredential as similar code is working for app service without specifying the storage connection string.
I have specify all the env variables

#### Actual behavior
Function app unable to start and giving error due to failure in fetching token for queue and blob.
Contributor guide
Research direction
No repository files or tests are identified. Start by reviewing the Azure Functions v4 managed identity configuration, the DefaultCredential usage with Azure.Storage.Blobs and Azure.Storage.Queues, and the listed environment variables and role permissions; done means the function can access both blob and queue operations without the 403 errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp
- Domain
- authentication, authorization, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100