Skill Updates: Azure Functions TypeScript Deployment Issues

Background

During deployment of a TypeScript Azure Function with Event Hub trigger, several issues were encountered that could have been prevented with better skill guidance. This document captures the learnings and proposed updates.

Repro

0. make sure you have github copilot cli and azure plugin

1. mkdir skills-event-hubs

2. code .
   <create Function -> TypeScript (Node.js) -> Event Hub listener>

3. run copilot cli and make sure you have GHCP for azure plugin (the Skills)

copilot
/plugin uninstall azure
/plugin install microsoft/github-copilot-for-azure:plugin

4. "deploy this function to Azure"

Issues Encountered

Issue 1: Policy Violation - Event Hub Local Auth

Error:

RequestDisallowedByPolicy: Resource 'evhns-xxx' was disallowed by policy.
Reasons: 'Local authentication methods are not allowed.'

Root Cause: Generated Bicep for Event Hub namespace did not include disableLocalAuth: true.

Resolution: Added the property to Bicep.

---

Issue 2: Did Not Use Existing Template

What Happened: Agent wrote Bicep from scratch instead of using azd init -t <template>.

Root Cause: The decision tree in functions-templates.md pointed to a generic samples page URL rather than specific azd init commands. The agent did not follow through to find the actual template.

Existing Templates Found:

• Azure-Samples/functions-quickstart-dotnet-azd-eventhub
• Azure-Samples/functions-quickstart-python-azd-eventhub

---

Issue 3: TypeScript Remote Build Failure

Error:

sh: 1: tsc: Permission denied

Actual Root Cause: The .funcignore file had incorrect entries that:

1. Excluded *.ts files - preventing Oryx from seeing TypeScript source
2. Excluded tsconfig.json - preventing Oryx from compiling
3. Did NOT exclude node_modules/ - uploading local binaries with wrong permissions

Correct .funcignore (enables remote build):

*.js.map
.git*
.vscode
__azurite_db*__.json
__blobstorage__
__queuestorage__
local.settings.json
test
node_modules/     # REQUIRED - excludes local binaries

Reference: https://github.com/Azure-Samples/remote-mcp-functions-typescript/pull/35

---

Issue 4: Application Insights Not Receiving Traces

Symptom: No traces appearing in Application Insights after deployment.

Root Cause: When DisableLocalAuth: true is set on Application Insights (required by enterprise policy), identity-based authentication requires:

1. App Setting: APPLICATIONINSIGHTS_AUTHENTICATION_STRING with value ClientId=<managed-identity-client-id>;Authorization=AAD
2. RBAC Role: Monitoring Metrics Publisher role assigned to the managed identity on the Application Insights resource

---

Proposed Skill File Updates

File 1: azure-prepare/references/recipes/azd/functions-templates.md

Update 1A: Event Hubs Template Section (lines 55-57)

Replace with:

8. Does it use Event Hubs for streaming?
   Indicators: EventHubTrigger, @app.event_hub, event_hub_output, streaming
   └─► YES → Use Event Hubs Template:
       | Runtime | Template Command |
       |---------|-----------------|
       | .NET | `azd init -t Azure-Samples/functions-quickstart-dotnet-azd-eventhub` |
       | Python | `azd init -t Azure-Samples/functions-quickstart-python-azd-eventhub` |
       | TypeScript/JS | No template yet. Use .NET or Python template infra, adapt azure.yaml for Node.js |

Update 1B: Add New Section - TypeScript .funcignore Configuration

Add guidance on correct .funcignore for TypeScript with remote build:

• Exclude node_modules/
• Do NOT exclude *.ts or tsconfig.json

Update 1C: Add New Section - Enterprise Policy Compliance

Add default disableLocalAuth: true for Event Hubs, Storage, App Insights, Service Bus.

Update 1D: Add New Section - Application Insights Identity-Based Authentication

Add required app settings and RBAC role for identity-based App Insights auth.

File 2: azure-prepare/SKILL.md

Update 2A: Add Rule 7 - Template-First Requirement

7. **ALWAYS use `azd init -t <template>`** when a matching template exists in the decision tree.

File 3: azure-prepare/references/recipes/azd/azure-yaml.md

Update 3A: Add TypeScript and .funcignore Guidance

Document two valid approaches (remote build vs local build) and common errors.

---

Summary of Changes

File	Change Type	Description
functions-templates.md	Update	Event Hubs section - add specific azd init commands
functions-templates.md	Add Section	TypeScript .funcignore configuration
functions-templates.md	Add Section	Enterprise policy compliance defaults
functions-templates.md	Add Section	Application Insights identity-based authentication
SKILL.md	Add Rule	Template-first enforcement (Rule 7)
azure-yaml.md	Add Section	TypeScript deployment approaches

---

References

• Official TypeScript template: https://github.com/Azure-Samples/functions-quickstart-typescript-azd
• Event Hubs .NET template: https://github.com/Azure-Samples/functions-quickstart-dotnet-azd-eventhub
• Event Hubs Python template: https://github.com/Azure-Samples/functions-quickstart-python-azd-eventhub
• Flex Consumption samples: https://github.com/Azure-Samples/azure-functions-flex-consumption-samples
• TypeScript .funcignore fix PR: https://github.com/Azure-Samples/remote-mcp-functions-typescript/pull/35