Question

You have an Azure Function app that must read blobs from an Azure Storage account in the same subscription. Security policy prohibits storing any secrets, connection strings, or keys in application settings or code. You want the Function to authenticate to Storage using Microsoft Entra ID with the least administrative overhead. What should you do?

Accepted Answer

Enable a system-assigned managed identity on the Function app and grant it the Storage Blob Data Reader role on the storage account.

Answer

Register an application in Microsoft Entra ID, create a client secret, and store the secret in the Function app's application settings.

Answer

Generate a storage account shared access signature (SAS) token and reference it from the Function app's configuration.

Answer

Create a user-assigned managed identity, assign it to the Function app, and grant it the Storage Account Contributor role.