Quickstart: Create a service connection in Azure Functions with the Azure CLI

This quickstart shows you how to connect Azure Functions to other Cloud resources using Azure CLI and Service Connector. Service Connector lets you quickly connect compute services to cloud services, while managing your connection's authentication and networking settings.

If you don't have an Azure subscription, create an Azure free account before you begin.

Prerequisites

• Use the Bash environment in Azure Cloud Shell. For more information, see Quickstart for Bash in Azure Cloud Shell.

  

• If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.

  • If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.

  • When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.

  • Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

• This quickstart requires version 2.30.0 or higher of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.
• This quickstart assumes that you already have an Azure Function. If you don't have one yet, create an Azure Function.
• This quickstart assumes that you already have an Azure Storage account. If you don't have one yet, create an Azure Storage account.

Initial set-up

1. If you're using Service Connector for the first time, start by running the command az provider register to register the Service Connector resource provider.

   az provider register -n Microsoft.ServiceLinker
   

   Tip

   You can check if the resource provider has already been registered by running the command az provider show -n "Microsoft.ServiceLinker" --query registrationState. If the output is Registered, then Service Connector has already been registered.

2. Optionally, use the Azure CLI az functionapp connection list-support-types command to get a list of supported target services for Function App.

   az functionapp connection list-support-types --output table
   

Create a service connection

Using a managed identity

Important

Using Managed Identity requires you have the permission to Azure AD role assignment. If you don't have the permission, your connection creation will fail. You can ask your subscription owner for the permission or use an access key to create the connection.

Use the Azure CLI az functionapp connection command to create a service connection to a Blob Storage with a system-assigned managed identity, providing the following information:

• Source compute service resource group name: the resource group name of the Function App.
• Function App name: the name of your FunctionApp that connects to the target service.
• Target service resource group name: the resource group name of the Blob Storage.
• Storage account name: the account name of your Blob Storage.

az functionapp connection create storage-blob --system-identity

Note

If you don't have a Blob Storage, you can run az functionapp connection create storage-blob --new --system-identity to provision a new one and directly get connected to your function app.

Using an access key

Warning

Microsoft recommends that you use the most secure authentication flow available. The authentication flow described in this procedure requires a very high degree of trust in the application, and carries risks that are not present in other flows. You should only use this flow when other more secure flows, such as managed identities, aren't viable.

Use the Azure CLI az functionapp connection create command to create a service connection to an Azure Blob Storage with an access key, providing the following information:

• Source compute service resource group name: the resource group name of the Function App.
• Function App name: the name of your Function App that connects to the target service.
• Target service resource group name: the resource group name of the Blob Storage.
• Storage account name: the account name of your Blob Storage.

az functionapp connection create storage-blob --secret

Note

If you don't have a Blob Storage, you can run az functionapp connection create storage-blob --new --secret to provision a new one and directly get connected to your function app.

View connections

Use the Azure CLI az functionapp connection list command to list connections to your Function App, providing the following information:

• Source compute service resource group name: the resource group name of the Function App.
• Function App name: the name of your Function App that connects to the target service.

az functionapp connection list -g "<your-function-app-resource-group>" -n "<your-function-app-name>" --output table

Next steps

Follow the tutorials below to start building your own function application with Service Connector.

Tutorial: Python function with Azure Queue Storage as trigger

Tutorial: Python function with Azure Blob Storage as input

Tutorial: Python function with Azure Table Storage as output