When a Dataverse support case is created, an external system must be notified immediately through an Azure Function. The team wants Dataverse to call the function directly without a queue, and the endpoint must reject callers that do not present a shared secret. How should the developer configure this?

Dataverse webhooks send an HTTP POST containing the execution context to a registered URL when a step fires, which makes an HTTP-triggered Azure Function a natural receiver. The webhook registration supports authentication options that add a value to each request, such as an HTTP header, a webhook key, or a query string parameter. An Azure Function with function-level authorization expects its key in the x-functions-key header or the code query parameter, so registering the webhook with that key means only callers holding the secret reach the code. The step is registered on Create of the case table. Anonymous access with a user-agent filter offers no real protection, because any caller can set that header to any value. A Service Bus service endpoint expects a namespace and queue or topic credentials; it posts to Service Bus, not to an HTTP function URL, so the configuration would not deliver to the function. A polling timer function adds latency, consumes API requests continuously, and has to track which rows were already processed, contradicting the requirement for immediate notification by Dataverse. Exam caveat: a synchronous webhook step can roll back the case save when the function returns an error, so register asynchronously unless the save must depend on the call. Operational check: create a test case and confirm a 200 response in the function logs, then confirm a request without the key receives 401.