Azure / Azure/bicep-registry-modules

[AVM Module Issue]: unnecessary environment variables set for storage account creating conflict

Open
#6,546 7 comments 0 reactions 2 assignees Claimed by @tsc-buddy View on GitHub
Class: Resource Module :package: Type: AVM :a: :v: :m: Type: Bug :bug:
Dominant language
Bicep
Stars
736
Forks
564
Avg merge
3d 15h
Merged PRs (30d)
30

Description

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Issue Type?

Bug

### Module Name

avm/res/web/site

### (Optional) Module Version

latest

### Description

Description
In the site/config module, when a Storage Account is provided, the module configures four environment variables related to Function App host storage, including:

Storage account name
Blob service URI
Queue service URI
Table service URI

This behavior occurs even when the Function App is configured to use a system-assigned identity for accessing host storage.

Problem Statement
I recently ran into issues related to Function App host storage and reached out to Azure Support. They confirmed that, according to current official Microsoft documentation, when a Function App uses a system-assigned managed identity to connect to host storage, only the storage account name environment variable is required.
The additional service-specific URI environment variables (Blob/Queue/Table) are not required in this scenario and do not appear in Microsoft’s official examples.

Expected Behavior
When a Function App uses a system-assigned identity for host storage access:

Only the storage account name environment variable should be configured.
Explicit service URIs (Blob/Queue/Table) should not be required unless there is a documented requirement.

Aligning the module behavior with official guidance would help avoid unnecessary configuration and potential confusion.

References
Azure Support pointed me to the following official resources:

Microsoft Learn – Connecting to host storage with an identity
https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob&pivots=programming-language-csharp#connecting-to-host-storage-with-an-identity

Azure Quickstart Template – Function App (system-assigned identity)
https://github.com/Azure/azure-quickstart-templates/blob/master/quickstarts/microsoft.web/function-app-flex-managed-identities/main.bicep

Both references demonstrate usage where only the storage account name is configured when using a system-assigned identity.

### (Optional) Correlation Id

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.