Search code examples
azureazure-functionsazure-managed-identity

deploying azure function app that uses a system assigned managed identity

We have an azure function app that uses a system assigned managed identity to access resources.

I have not found a way to use this system assigned identity when deploying the function app via devops. e.g.

  • deploy the function app.
  • enable the system assigned identity.
  • grant function app access to key vault with the system assigned managed identity.

is this a case where the system assigned identity simply does not work and i need to create one manually ?

Solution

  • First of all, if you want to deploy the function app via DevOps using managed identity created by the azure function, the answer is no.

    See here:

    https://learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops#create-an-azure-resource-manager-service-connection-to-a-vm-with-a-managed-service-identity

    You are required to use a self-hosted agent on an Azure VM in order to use managed service identity.

    Follow the steps above if you want to use manage identity to integrate with DevOps.

    A system-assigned managed identity is enabled directly on an Azure service instance. When the identity is enabled in your azure function app service instance, Azure creates an identity for the azure function app instance in the Azure AD tenant that's trusted by the subscription of the instance. After the identity is created, the credentials are provisioned onto the azure function app instance.

    You can find it in Enterprise applications of AAD.

    enter image description here

    enter image description here This application has nothing to do with the credentials required to deploy azure functions from DevOps.

    The managed identity you create with the 'enable' button is mainly used to manage the access rights of the azure function app instance to other service instances in azure.