Azure / Azure/azure-functions-sql-extension
Azure Functions SQL triggers using managed identity may not scale correctly on Flex Consumption
- Dominant language
- C#
- Stars
- 130
- Forks
- 71
- Avg merge
- 4d 8h
- Merged PRs (30d)
- 4
Description
Azure Functions SQL triggers configured with Microsoft Entra managed identity authentication may fail to start or process change tracking events on Flex Consumption. Both system-assigned and user-assigned managed identities can be affected.
In some cases, an already-running trigger continues to process changes, but SQL Server records repeated error `33155`: `A disconnect event was raised when server is waiting for Federated Authentication token`. These messages describe failed connection attempts and do not necessarily indicate that the SQL Server instance or active trigger listener has failed.
## Cause
The Flex Consumption scale controller does not currently provide a managed identity token credential to the SQL trigger scaler. As a result, the scaler cannot authenticate when checking for pending database changes.
If no instance is already available for the SQL trigger, the function cannot scale out and its listener is never created. When an instance is available, the listener may continue working while failed or abandoned scaler authentication attempts produce repeated federated-authentication errors in the SQL Server log.
## Workarounds
- Configure an **Always Ready** instance for the SQL trigger function group. This keeps an instance available so the in-app listener can run using managed identity without depending on the affected scale operation.
- Temporarily use SQL username and password authentication for the trigger connection. This restores normal listener startup and scaling but does not provide credentialless authentication.
- If the repeated SQL Server log entries are the primary concern and neither workaround is suitable, disabling the SQL trigger stops the affected polling activity, but also stops change processing.
Contributor guide
Research direction
Start by tracing the Flex Consumption scale controller's SQL trigger scaler and how it obtains credentials for managed-identity connections. Reproduce the no-instance and existing-instance cases described in the issue, then verify that scaling, listener creation, and change tracking work without repeated SQL Server error 33155 messages.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, sql
- Domain
- backend, cloud, database
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100