Need to use service principal in datalake connection string instead of storage key

Question

Hello Team,

I hope you are doing well.

Currently in function app customer using connection string which is consist of storage key but now he wants to use service principal in connection string please let me know how to format connection string: current connection string is like that:

DefaultEndpointsProtocol=https;AccountName=?????????????????=??????????????????????????????/????????????????????/??????????/???????+1+???????????==

Customer later stated he need to connect from AZURE FUNCTION APP only.

So just want to know how to define azure storage queue connection in function.json file with Service principal.

Please any help will be much appreciated. Many thanks

Answer 1

Better you need to avoid the conn string format that uses the storage key and instead leverage Azure Active Directory (Azure AD) auth.

Here is how you can configure it:

1. Create a Service Principal: If you haven't already, register an application in Azure Active Directory and assign the necessary role (such as "Storage Blob Data Contributor") to the service principal on the target Azure Storage account.
2. Add necessary information to the configuration: In your Function App's local.settings.json or in the Azure portal under "Configuration" for the Function App, define the following environment variables:
   • AZURE_CLIENT_ID: The client ID of the service principal.
   • AZURE_CLIENT_SECRET: The client secret for the service principal.
   • AZURE_TENANT_ID: The tenant ID of your Azure AD.
   • STORAGE_ACCOUNT_NAME: Your Azure Storage account name.
3. Use Azure SDK with DefaultAzureCredential: When connecting to the storage account, use the Azure SDKs that support Azure AD authentication, such as the @azure/storage-blob package in Node.js or Azure.Storage.Blobs in C#.
4. Azure Function's function.json: If you need to configure this in your function.json, you typically won’t pass the connection string directly like in the storage key approach. Instead, use environment variables and pass the account name and the authentication details programmatically in your function code. This method removes the need to store sensitive keys in your configuration and uses the more secure AAD authentication via the service principal