Fabric AppBackend rejects Functions deployment and leaves typed UDF route unregistered

What happened?

A Rayfin Fabric AppBackend deploys successfully with data, auth, and static hosting, but enabling the documented Functions service causes the deployment to fail during runtime settings configuration.

The CLI returns HTTP 400 with:

Functions are not supported yet. Please disable functions in your settings to try again.

When Functions are disabled, the full rayfin up deployment succeeds, but the typed production invocation route remains unregistered and returns HTTP 404:

.../workloads/BaaS/BaaSService/automatic/v1/workspaces/6689db97-112f-4f77-866d-115d71e8647c/appbackends/4702b663-09e7-45dc-81a2-df823bdf60c5/functions/askAtmOperationsCopilot/invoke

Expected behavior

A TypeScript UDF created with @microsoft/fabric-user-data-functions, registered with UserDataFunctions, and invoked through the typed RayfinClient.functions API should deploy with the AppBackend and expose its production invocation route. If Functions requires tenant/capacity allowlisting, the required activation process should be documented and the CLI should identify that prerequisite.

Actual behavior

• services.functions.enabled: true blocks the entire AppBackend deployment with HTTP 400.
• services.functions.enabled: false restores successful static/data/auth deployment.
• The hosted client then receives HTTP 404 from the expected function invocation route because no production function is registered.
• functionsBaseUrl is documented as a local-debug override only, so there is no supported production endpoint workaround.

Environment

• Rayfin CLI and SDK: 1.34.0 (latest published version)
• Fabric tenant: 481752bc-6d8f-450f-9d7f-613184c5d710
• Capacity: 5386c18f-317d-4850-abf1-480e5d47a305
• Workspace: 6689db97-112f-4f77-866d-115d71e8647c
• App Backend: 4702b663-09e7-45dc-81a2-df823bdf60c5
• Region: North Central US
• Functions worker package: @microsoft/fabric-user-data-functions@1.36.0-alpha.1588
• OS: Windows 11 ARM64

Configuration

services:
  auth:
    enabled: true
    fabric:
      enabled: true
  data:
    enabled: true
    dialect: mssql
  staticHosting:
    enabled: true
    folder: dist
    buildCommand: npm run build:fabric
  functions:
    enabled: true
    buildCommand: npm run build

The function builds successfully and uses the documented delegated connection pattern:

udf.func(
  'askAtmOperationsCopilot',
  async (request, ctx) => {
    const token = ctx.getToken(AudienceType.AzureAI);
    // Invoke Microsoft Foundry using the delegated token.
  },
  [udf.connection({ audienceType: AudienceType.AzureAI })],
);

Reproduction

1. Add a valid TypeScript function under rayfin/functions/ and generate the typed schema.
2. Set services.functions.enabled: true in rayfin/rayfin.yml.
3. Run the canonical full deployment with npx rayfin up.
4. Observe the HTTP 400 unsupported-Functions error.
5. Set services.functions.enabled: false and redeploy.
6. Observe a successful deployment, but HTTP 404 from the expected production invocation route.

Current safe workaround

Functions remain disabled so Fabricator and full rayfin up deployments stay operational. The UDF source and typed client contract are retained, and the application explicitly labels its deterministic fallback instead of claiming a governed response.

Request

Please confirm whether Functions can be enabled/allowlisted for this tenant, capacity, workspace, and AppBackend. If this AppBackend type or region does not support Functions yet, please document the supported matrix and expected enablement timeline.

Start with rayfin/rayfin.yml, the TypeScript source under rayfin/functions/, and the typed RayfinClient.functions invocation described in the report. Run npx rayfin up with services.functions.enabled set to true and false, comparing the HTTP 400 deployment failure with the successful deployment and HTTP 404 route. Done means confirming the supported AppBackend and region prerequisites, or documenting the required enablement process and supported matrix.