A municipal Function app has a system-assigned managed identity ena…

Question

A municipal Function app has a system-assigned managed identity enabled, but blob reads still return 403. What should the security engineer do?

Accepted Answer

Assign the appropriate built-in Azure role to the Function app’s managed identity on the storage account or container. — Identity’s on, but Storage still says “who are you?” Slap Storage Blob Data Reader (or the right built-in role) on that managed identity at the account or container—no new client secrets.

Answer

Create a new client secret on a separate app registration and hard-code it in the Function app settings.

Answer

Switch the storage account to allow anonymous public blob access so the Function no longer needs identity.

Answer

Disable the system-assigned identity and rely only on the storage account access key in Application Insights.

A municipal Function app has a system-assigned managed identity enabled, but blob reads still return 403. What should the security engineer do?

Short Explanation

Full Explanation