Azure / Azure/azure-functions-sql-extension

Azure Functions SQL triggers using managed identity may not scale correctly on Flex Consumption

Open
#1,235 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
130
Forks
71
Avg merge
4d 8h
Merged PRs (30d)
4

Description

Azure Functions SQL triggers configured with Microsoft Entra managed identity authentication may fail to start or process change tracking events on Flex Consumption. Both system-assigned and user-assigned managed identities can be affected.

In some cases, an already-running trigger continues to process changes, but SQL Server records repeated error `33155`: `A disconnect event was raised when server is waiting for Federated Authentication token`. These messages describe failed connection attempts and do not necessarily indicate that the SQL Server instance or active trigger listener has failed.

## Cause

The Flex Consumption scale controller does not currently provide a managed identity token credential to the SQL trigger scaler. As a result, the scaler cannot authenticate when checking for pending database changes.

If no instance is already available for the SQL trigger, the function cannot scale out and its listener is never created. When an instance is available, the listener may continue working while failed or abandoned scaler authentication attempts produce repeated federated-authentication errors in the SQL Server log.

## Workarounds

- Configure an **Always Ready** instance for the SQL trigger function group. This keeps an instance available so the in-app listener can run using managed identity without depending on the affected scale operation.
- Temporarily use SQL username and password authentication for the trigger connection. This restores normal listener startup and scaling but does not provide credentialless authentication.
- If the repeated SQL Server log entries are the primary concern and neither workaround is suitable, disabling the SQL trigger stops the affected polling activity, but also stops change processing.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the Flex Consumption scale controller's SQL trigger scaler and how it obtains credentials for managed-identity connections. Reproduce the no-instance and existing-instance cases described in the issue, then verify that scaling, listener creation, and change tracking work without repeated SQL Server error 33155 messages.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, sql
Domain
backend, cloud, database
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.