0

I am trying to call a Function app from ADF using MSI. I have enabled managed identity for ADF as well as have enabled AAD authentication/authorization for Function app.

enter image description here

Now when I make a web call from ADF (with the underlying specification)

enter image description here

I get the following error.

enter image description here

I even added ADF as contributor to Function App. I must be missing something, but not sure what exactly

LoniF
  • 97
  • 1
  • 1
  • 7
  • 1
    AAD on the Function might be evaluating the MSI of ADF. To test function within the FunctionApp, browse to the `Function Keys` if there none add new. Else copy the key and build the url in the ADF as `https://.azurewebsites.net/api/?code=` – koushik Mar 02 '21 at 15:08
  • Thank you for your input @koushik. That indeed might work, but the intention is to enable a secured integration, without having to use/expose keys. Hence, looking for something that will enable to authenticate through MSI. – LoniF Mar 03 '21 at 06:51
  • @JosephXu yes they are! clearly I am missing something. can you please share the steps...that will be very helpful. I can then try it out – LoniF Mar 03 '21 at 07:32

1 Answers1

2

First of all, please make sure you selected the Create New AD App option when you configure the function app with Azure AD auth, then azure will do all the configurations for you automatically, this will reduce unnecessary trouble. Also remember to set Authorization level of your function to Anonymous, because we configured the function app with Azure AD auth.

In your case, the error was caused by the wrong Resource, it should be the Application ID URI of the AD App corresponded to the function app, i.e. https://<functionapp-name>.azurewebsites.net(this is configured by azure automatically when you select Create New AD App as mentioned above).

Besides, you should note, if you just do the steps above, all the service principals(MSI is essentially a service principal)/users in your AAD tenant can access the function app, if you just want your MSI to access the function app, then you need to leverage the Azure AD App role, I have posted the details here, if you don't mind this, just ignore the step 2 and step 3, it will also work.

Joy Wang
  • 39,905
  • 3
  • 30
  • 54
  • thank you for helping out on this. It indeed solved the issue. The error was the wrong Resource. After replacing it with `https://.azurewebsites.net` it worked perfectly! – LoniF Mar 04 '21 at 08:21