Search code examples
azureloggingazure-storageazure-functions

How to share Azure Function logs with 3rd party

I have some Azure Functions that I share to my partner companies who then run the Azure Functions in their own Azure subscriptions.

Occasionally the partners run into issues and reach out to me for help. I have to instruct them to manually pull the Azure Function logs and send to me via email.

Is there anyway they can grant me permission to pull the logs from their Azure Subscription?

Solution

  • It depends on where you have the logs.

    Either way, they can grant you RBAC permission to their resource in their subscription. Generally, they have read only access options available. All resources have the same experience for modifying RBAC (but they do differ on which policies they support). It's pretty straightforward, but this doc has more information: https://learn.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure

    If you're using our default Storage logs, do yourself a favor and turn on App Insights because it's great. Then, if you still want to use Storage, you can get RBAC access or a SAS token and grab those logs from the Storage Account associated with the Function App. (Name should be in the AzureWebJobsDashboard setting). If you get a SAS token, you can use the Storage Explorer by choosing the SAS URI option when you connect.

    Storage Explorer Connection UI with SAS URI selected

    If you're using App Insights, good job, you've made the right decision. You can get RBAC access to the App Insights resource and use all their great UI experience/etc. You can also get an API Key and make direct API calls against it, in the case that RBAC wouldn't work. (I would try to get RBAC access, but if that's not possible, here's a link to App Insights REST API docs: https://dev.applicationinsights.io/quickstart)

    Short answer, use RBAC to get granted limited permissions (and App Insights because it's great)