A botanical public weather HTTP function should be callable without a key, while a blood-bank donor-update HTTP function must require the function key. Which Functions configuration distinguishes those endpoints?
Select an answer to reveal the explanation.
Short Explanation
Authorization level is the door lock on an HTTP trigger—Anonymous means open garden gate; Function means you need the key. Entra ID is a bigger identity story (Domain 3); start here with the trigger’s authLevel for these two city endpoints.
Full Explanation
The botanical public weather HTTP function should be callable without a key, while the blood-bank donor-update HTTP function must require the function key. Distinguish them with the HTTP trigger authorization level: Anonymous for weather, and Function (or Admin) for donor updates. Authorization level is configured on each HTTP trigger and controls whether the runtime demands a function or master key on the request. That per-function lock is the create/configure skill for these two municipal endpoints.
Microsoft Entra ID user sign-in as the only option for every HTTP function jumps to a broader Easy Auth / identity story (often Domain 3) and is heavier than the trigger authLevel distinction asked here; it also fails the requirement that weather stay anonymously callable without that identity flow. Always On enabled for anonymous routes and disabled for keyed routes does not enforce keys—Always On only affects idle unload behavior on supported plans. CORS allowed origins alone never enforces function-key presence; CORS governs browser cross-origin reads, not Functions key authorization.
Exam caveat: Admin level uses the master host key and should be rare for application callers—prefer Function level for normal keyed APIs. Operational check: call the weather endpoint without an x-functions-key (or code query) and confirm 200; call the donor-update endpoint without a key and confirm 401/unauthorized, then retry with the function key and confirm success.