Azure Function App Read-only on functions

Joey 0

How can I create a custom role in Azure that allows users to view Function App code in read-only mode? Currently, users with the built-in Reader role can see the Function App but get an error requiring write permissions when trying to view the actual function code. Looking for a solution that maintains read-only access while enabling code viewing.

I tried a bunch of things with custom roles but can't seem to get it working.

Shireesha Eeraboina (Quadrant Resource LLC) 655 Reputation points Microsoft Vendor

2025-01-10T05:41:56.3833333+00:00

Hi @Joey,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Creating a custom role in Azure that allows users to view Function App code in read-only mode can be a bit tricky, but I can guide you through the process. Here's a step-by-step approach to achieve this:

Determine the Required Permissions:

First you need to grant read-only access to the Function App code. The specific permissions required are Microsoft.Web/sites/config/list/action and Microsoft.Web/sites/sourcecontrols/read.

Create the Custom Role:

You can create a custom role using the Azure portal, Azure PowerShell, Azure CLI, or the REST API. Here, I'll show you how to do it using the Azure portal.

Steps to Create the Custom Role in Azure Portal:

First go to the Azure portal and sign in with your credentials and then navigate to the subscription or resource group where you want to create the custom role and click on "Access control (IAM) Then Click on "+ Add" and select "Add custom role" here provide a name and description for your custom role, under "Permissions", click on "Add permissions". Search for Microsoft.Web/sites/config/list/action and Microsoft.Web/sites/sourcecontrols/read and add them to the role after that review the settings and click on "Create" to finalize the custom role.

Also please find the screenshot below for your reference:

Assign the Custom Role:

Once the custom role is created, you need to assign it to the users or groups who need read-only access to the Function App code.

For that go to the Function App in the Azure portal and Click on Access control (IAM) here Click on "+ Add" and select "Add role assignment" and choose the custom role you created and assign it to the desired users or groups.

Also please find the below screenshot for your reference:

By following these steps, you should be able to create a custom role that allows users to view Function App code in read-only mode without encountering write permission errors.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thankyou.
Joey 0 Reputation points

2025-01-10T13:42:12.5333333+00:00

Hi, thanks! I really appreciate the time you took to answer my question. Unfortunately, I still can't get it working by following your steps.

I created the custom role with the following permision and made sure the role is active.

After I added the test user account:

So the error about the write permissions needed is gone but I still get this one:

Share via

Azure Function App Read-only on functions

Your answer