Azure functions use-queue trigger with managed identity- Storage Queue Data Contributor Role

Question

I am using Azure Queue Trigger v4 to get it triggered through managed identity having Storage Queue Data Contributor Role, but when new message is added in Queue, this azure function does not get triggered. I checked the application insight but there is no error.


[FunctionName("TestSyncFunction")]
    public async Task Run(
    [QueueTrigger("file-queue", Connection = "QueueConection")] QueueMessage queueMessage,
    ILogger log)
    {
      log.LogInformation($"TestSyncFunction function executed at: {DateTime.Now}");
      
    }

//My local.settings.json looks like this: "QueueConection__queueServiceUri": "https://xyz.queue.core.windows.net/", "QueueConection__credential": "managedidentity"

Also, I referred to 2 existing links but there is no help at all.

Azure Functions - use queue trigger with managed identity

on Azure portal, locally it will not work since I don't have access to managed identity. — Abhishek P, Aug 23 '23 at 10:27
local.settings.json QueueConection":"your storageconnection string: In managed identity, we dont have to use the storageconnection string, its a direct url to your queue. refer this: https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob#local-development-with-identity-based-connections — Abhishek P, Aug 23 '23 at 10:32
I already sent the message in Queue manually, I have done all testing but its not triggering the Azure queue function, — Abhishek P, Aug 23 '23 at 10:33
are you using system-assigned identity or user-assigned identity here? — Ikhtesam Afrin, Aug 23 '23 at 10:56
yes, as described in the description, I am using managed identity having a contributor role. — Abhishek P, Aug 23 '23 at 12:01
have you updated the package to `Microsoft.Azure.WebJobs.Extensions.Storage.Queues" Version="5.1.3` — Ikhtesam Afrin, Aug 23 '23 at 13:26
Hope you have granted `Storage Queue Data Reader, Storage Queue Data Message Processor` RABC roles to your function app in the storage account — Ikhtesam Afrin, Aug 23 '23 at 14:31
I have only Storage Queue Data Contributor Role access and I think this is enough to trigger the Azure Queue. — Abhishek P, Aug 23 '23 at 15:24

score 0 · Answer 1 · answered Aug 24 '23 at 05:09

I have reproduced the issue and got the expected output using following steps-

Primarily I updated the package to Microsoft.Azure.WebJobs.Extensions.Storage.Queues" Version="5.1.3 and then added the following roles to my function app in storage account as stated in MS Docs.

enter image description here

Once you added these roles, then you will be able to see them in your function app as below

enter image description here

Then I added the below role to my account in the storage account-

enter image description here

I have tested my function locally as well as in Portal and it worked as expected in both cases.

Code:

public class Function1
    {
        [FunctionName("TestSyncFunction")]
        public void Run([QueueTrigger("sample-queue", Connection = "QueueConection")]string myQueueItem, ILogger log)
        {
            log.LogInformation($"C# Queue trigger function processed: {myQueueItem}");
        }
    }

local.setting

{
    "IsEncrypted": false,
  "Values": {
    "AzureWebJobsStorage": "UseDevelopmentStorage=true",
    "FUNCTIONS_WORKER_RUNTIME": "dotnet",
    "QueueConection__queueServiceUri": "https://<storageaccount name>.queue.core.windows.net/"
  }
}

Local Output:

enter image description here

Portal:

App Settings

enter image description here

Application Insight:

enter image description here

Azure functions use-queue trigger with managed identity- Storage Queue Data Contributor Role

1 Answers1