Thanks for taking this up @jeffhollan. zip ). On Function options, it shows the below warning: I found this thread which says there should be an option of 'Develop in Portal' but I am not able to find it-----Edit-1-----After going through "Pravallika's" answer I tried one more time to create a function from Scratch and it seems. 1. Virtual Machine Scale Sets Manage and scale up to thousands of Linux and Windows VMs1 answer. If the Function App was hosted on Dedicated hosting plan, then we have a way to restore it. Code project. For new functions, we are trying to migrate to managed identities. This was certainly unexpected and obviously catastrophic. When declaring a module, you can set a scope for the module that is different than the scope for the containing Bicep file. Using az cli I'm able to deploy src (a total of 5 workflows), can see the list, enter any ws and edit it, but if I press on run I get. name storage_account_access_key =. We have Azure Function Apps with VNet integration configured in order to be able to access other Azure resources that have network restrictions (databases, key vaults, storage accounts) using service endpoints. json which will function as the "main" template and will be used for other release pipelines as well. Reload to refresh your session. But the timetriggers are not firing. siteConfig: { pythonVersion: '3. Just converted to new GitHub App Services Action Build And Deployment Pipeline and getting the following error: Run azure/webapps-deploy@v2 with: app-name: publish-profile: slot-name: package: . – In your Storage Account, ensure the setting ” Enabled from selected virtual networks and IP addresses” is on and the subnet your App is integrated with is included in the list. Thanks for opening this issue - apologies for the delayed response here! At this time there isn't a specific resource for Function App Slots (support for this is being tracked in #1307) - however as many folks have noticed they're structurally similar to App Service Slots and thus it's possible to reuse them in some cases. It looks like you can connect to a secured storage account using run from package as a URL and that will allow your code to be stored in a VNET secured storage accountIs there an existing issue for this? I have searched the existing issues; Community Note. Many legacy functions use connection strings, and those work well. Cindy Pau. Enable Network injection. This does not make sense because our app still works. You can refer to this document for operating system and language runtime support for the hosting plans. I've deployed and published several Function Apps without issues over the last 12 months. Since local. Reload to refresh your session. We identified a workaround for this scenario, and need to fully document it. There was a similar issue discussed in the following thread, even though it is for private link, the concept of vnet integration would remain the same. Source code setup for Azure Functions and run. The azure storage that is configured in the default create experience will have a public endpoint that the Logic Apps runtime will use for storing state of your workflows. I have a few Azure functions that process Service Bus messages. Key from Application Insights. The New-AzDeployment cmdlet adds a deployment at the current subscription scope. To ensure the correct site and prove you actually own it, add a text file d:homelogFiles emp. As far as I know there isn't even linkage built into KeyVault that would allow for automated secret rotation, so now I have. The body of the request is exactly the same as the template, the url is correct as I tested it with GET request and it worked well. Panic Output Expected Behaviour. 1. If you switch your app plan from standard to dynamic for a function app the special logic for app config vars WEBSITE_CONTENTAZUREFILECONNECTIONSTRING & WEBSITE. Identity, but it will suffice for me to "turn on" Managed Identity. Punny Stuff - Anthony Attwood. When we create an Azure Function App, it will create an Azure Storage Account where the content (code, json, etc…), required to run the Azure Functions are to be stored. When creating the publishing profiles, I simply used the "Create new profile" wizard in Visual Studio and chose "Select Existing" Azure App Service, and then drilled in on the "Int" Deployment Slot. Few things need to check: Storage account should be on selected network. Add the following settings to the appSettings array above: The next batch of settings is required to link the Function App to the Storage Account. The next step is to switch AzureWebJobsStorage to be secretless. ErrorEntity]: Bad Request (Fault Detail is equal to. In part 1 we saw how to send a custom event telemetry to an Azure Application Insights instance through PowerShell. Azure Functions can be deployed to Azure Arc-enabled Kubernetes. However, as of this week, when publishing a Function App using the following PowerShell script: func azure functionapp publish <functionAppName>…@v-bbalaiagar Thank you very much for you reply. Learn more about Collectives1 Answer. Anyway I'm experimenting problems in setting a storage account to a web app. Specifies the repository or provider to use for key storage. This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. Hey guys, the WEBSITE_CONTENTSHARE must be specified to a predefined file share according to the [docs](There are scenarios where you must set the WEBSITE_CONTENTSHARE value. 普段の業務でAzureのApp Serviceをよく触るのですが、Microsoftが提供しているApplication Settingに設定可能なKeyValueがまとまったドキュメントがなかったので備忘録がてらまとめてみました。. This is needed if your keyvault is open to only selected networks. Any updates on this? @callppatel we are using a similar work around as the one that you posted i. Hi, we enabled deployment slots in our ARM template and deploy thru MSDeploy, found out that actually when deployment happens, it not only deployed to the staging slot but also deployed to the production slot unexpectedly. I am unable to change any code through the Azure portal as it says…We would like to show you a description here but the site won’t allow us. If a call to either of the Configure () methods on the. Recently I am suggested to add WEBSITE_CONTENTAZUREFILECONNECTIONSTRING and WEBSITE_CONTENTSHARE. The Azure Resource Manager (ARM) REST API is an old management API for all your Azure needs. According to documentation the variable WEBSITE_CONTENTSHARE. Lateral Movement in Azure App Services. We can apply these roles at the account, database or container level. In the Create a new Azure Functions application choose . The Engineer (@v-lhoffmann) was extremely helpful in working with me to identify the root cause of the issue I had documented here: Azure/azure-functions-host#8992The root cause of the issue was that the managed. I tried to deploy the function in my function app using visual studio/VS code but couldn't observe any issue. Fetching changes. Azure App Service: WEBSITE_RUN_FROM_PACKAGE - does old zip files gets deleted? According to your description, it seems you want to empty the old zip files before a new deployment. Follow. 0-20130906. Contact Repository is a data integration service between Oriflame's internal systems and various external marketing tools (such as Salesforce Marketing Cloud). To do this we will grant the Function App the Key Vault Secret User role. Using raw Azure resources, I've attempted something like this to create a function app on my Application Service Plan: New-AzResource -ResourceType 'Microsoft. 1. This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. In this article, you use Azure Functions with an Azure Resource Manager template (ARM template) to create a function app and related resources in Azure. You can obtain the full definition by using the reference function. I am unable to change any code through the Azure portal as it says…I'm using pulumi to create and deploy an azure function app that contains two functions to scale up and scale down an azure sql database automatically. I then use the SAS key in the function app settings to tell it where to run from. @Bobi_Bao , Unfortunately if I have to keep using the secret to enable deployment and scale-out operations, I lose one of the key benefits of ManagedIdentity -- the benefit of not needing to automate secret rotation. Sample:Note. Deploy the Logic App Service. txt or alike with content. Automatic recommendations tell me to set these variables as they are essential for linux plans: while the documentation here states Only Check for a solution in the Azure portal For issues in production, please check for a solution to common issues in the Azure portal before opening a bug. ) --src "SomeApp. Deploy to azure portal. It appears that you are on a dedicated app service plan so this SKU supports Vnet integration. You appear to be using the zip_deploy_file attribute. Now we need to grant our function app access to retrieve secrets from the Key Vault. Stack Overflow Public questions & answers; Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers; Talent Build your employer brand Yes You can try Log analysis to identify any performance issues related to the settings you have added via the ARM template and Azure Monitor to monitor the. We have Azure Function Apps with VNet integration configured in order to be able to access other Azure resources that have network restrictions (databases, key vaults, storage accounts) using service endpoints. Hi @Alan Hunter . Note, the file share has to be created in advance. The clue is in the last line of the Microsoft document. Yes, the custom provider shows in the portal. All the production settings will be copied. The documentation is simply a list of autogenerated references, so it can be a pain. If it is, When using the Azure App Service Deploy task, and you are using the Publish using Web Deploy option, there is an additional option to Remove. zip file for deployment. Select C#. 1 Answer. The layout in the zip file should also be consistent with the zip file name. For instance, if your site name is mysecretsite, you can share part of prefix and suffix like mys. Hi, I've deployed and published several Function Apps without issues over the last 12 months. net')]" }, For Linux Consumption plan it is also required to add the two other settings in the site configuration: WEBSITE_CONTENTAZUREFILECONNECTIONSTRING and WEBSITE_CONTENTSHARE. Web App with custom Deployment slots. Learn how to use application settings in a function app to configure options that affect all functions in the app. This ARM template will allow access to the storage account through the private endpoints only. It appears that you are on a dedicated app service plan so this SKU supports Vnet integration. This lock is created by the name of the function App ‘appname’, which acts as. App settings and connection strings marked as slot settings will stay on the slot when a swap is done. I already tried 'allowing trusted Microsoft services' (ARM included) to bypass network restrictions and to enable the key vault for ARM deployments. Share partial info about your site name (enough to uniquely identify within the subscription). Community Note Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request Please do not leave "+1" or "me too" comments, th. KeyVault(. Think of your Azure Functions code project as a mechanism for organizing. Internally, the Timer triggers are executed on only one instance of the Function App. Do let me know if you have any queries. Then add the following as app setting, to the functions configuration. Select Diagnose and solve problems. As far as I know there isn't even linkage built into KeyVault that would allow for automated secret rotation, so now I have. Enabled the Private Endpoints for both the Blob and Queue on the Storage Account. The function app provides an execution context for your function code executions. So I created a vanilla HTTP triggered one, and tried to publish it, no code changes. As far as I know there isn't even linkage built into KeyVault that would allow for automated secret rotation, so now I have. I ran across this today. My Azure function has a staging and production slot. After pushing the project to repository Goto Azure portal -> Function App that you want to add HTTP trigger -> Select. 2 Answers. これらの設定は、環境変数としてアクセスされます。. . 前提. 0. I am trying to deploy an Azure Function App via Terraform I am getting the following errors when trying to represent the Function App settings: Error: azurerm_function_app. . Hi, I've tried to get an azure function app up and running with deployment slots using bicep templates. When trying to Publish the project from Visual Studio, click on New -> Select "Import Profile". Tried Reset publish credentials, but that didn't help either. However, all of these functions display a warning in Azure:2. Create a new function App. It will be closed if no further activity occurs within 3 days of this comment. During the upgrade (refactor). This is accomplished by setting WEBSITE_DNS_SERVER to 168. For your reference, you can use below template to deploy the function. An external startup class is a class registered with the FunctionsStartupAttribute. Azure Cosmos DB provides a number of built-in roles that allow us to authorize and authenticate data requests using Azure AD identities in a granular manner. Currently, the supported repositories are blob storage ("Blob") and the local file system ("Files"). Administration. These steps may vary depending on CI/CD such as Azure Repos,. I recently encountered an issue for which I ended up opening an Azure Support Ticket for (2212190010002007). While trying to create a new Slot, I faced this issue. I'm setting up an ARM template for my Azure Functions. You switched accounts on another tab or window. If you are using ARM template, maybe there is another binding setting missing so. WEBSITE_CONTENTSHARE = "share". I'm having the exact same problem. This allows the connection to the storage account to be made through the VNET integration. We are using RBAC for. Follow. The body of the request is exactly the same as the template, the url is correct as I tested it with GET request and it worked well. I used this web site toI have a virtual network, with a key vault and a function app (both have been linked via private endpoints and the function app has outbound traffic VNet integration set up). 5. Several months ago, I said to my boss - "oh, I'll use a function app. 4. As far as I know there isn't even linkage built into KeyVault that would allow for automated secret rotation, so now I have. We provide our. I have a Azure Function deployed on Premium App Service Plan (EP1). Our function apps also include a timer triggered function, so we specify the AzureWebJobsStorage setting as suggested: we would have guessed/hoped the runtime would have used that same connection string for the (now implicit) WEBSITE. @sescandell Please take a look at this page, especially at connecting to host storage with an identity section which talks about AzureWebJobsStorage. I confused this with a separate issue. I am new to the Azure Function App Technology. Oct 8, 2021, 7:48 AM. I am referring to a resource created using the custom provider. This was developed by someone in the past. Error: Failed to deploy web package to App Service. Running plan with azurerm_function_app and app_settings that include WEBSITE_CONTENTSHARE, we expect state to be maintained and change detection only if changed when we run a plan. Setting Up Continuous Deployment for Azure Functions. I am having the same problem, I cannot create a deployment slot off the main app if the app settings is using a key vault reference. 1. Create the Azure Function Scaffold a new Azure Function project. Hi @Steve Churcher , . The template can create all the resources but I'm having a hard time to get the switch to work, there seem to be some issues with the environment variables. Provide details and share your research! But avoid. Azure Functions with Private Endpoints. This blog shows you how to configure a function app using Azure Active Directory identities instead of secrets or connection strings, where possible. Any change to the application settings triggers an application restart. I've tried to solve it following Microsoft documentation, no luck. Apologize for the inconvenience caused on this. functions as func import os def default(o): """HI Team I have a requirement for one of the typical environment where i wanted to deploy Functionapp, its Storage everything associated to a Private Endpoint and wanted to store the Storage account. Whenever we run into an. With all that points the Function App was successfully created. I have functions_app. My Bicep Code referred from this Blog to Deploy Function app with Basic Authentication set to off:-. js workers. Enable virtual network integration for your function app. Deny all for advanced tool site with temporary whitelisting of deployment agent IP for any new deployments. Technical Blog Cloud Penetration Testing. Storage account name. Hi I have a function app which has two functions and they both work with Http Triggers. but it gives this message "This function has been edited through an external editor. Used by default for task hubs in Durable Functions. . You can increase the Maximum Burst to 100. To avoid this issue, you can skip the validation by setting WEBSITE_SKIP_CONTENTSHARE_VALIDATION to "1". using the below options using Bicep. At this point we have a build that produces a packaged web application that can be pushed to the Azure App Service hosting the Function App. Well doing so causes both Int AND Production to be deployed. Technically, it's a set of Azure functions that leverage other Azure resources (Blob Storage, Table Storage, Service Bus, etc. 16 and WEBSITE_VNET_ROUTE_ALL to 1. 3. In the portal, navigate to your app. Using Service Principal Role. Create or configure a second storage account. Thanks for reaching out to Q&A. When adding a slot to function app, it should be documented clearly that WEBSITE_CONTENTAZUREFILECONNECTIONS. We don't support Python language in V1 app and that's why the Function Host fails to. Enable the application content to be accessible over the virtual network. I have an Azure Functions App running on a consumption plan. Kudu is the engine behind git/hg deployments, WebJobs, and various other features in Azure Web Sites. For more information on the feature, see use dependency injection in . Kudu is the engine behind git/hg deployments, WebJobs, and various other features in Azure Web Sites. The functions are a mix of different triggers such as timer, and storage queue. Azure App Service is a service used to create and deploy scalable, mission-critical web apps. now I can't run it on each deployment because the deployments for the storage account dependencies don't (and shouldn't need to) know which storage key is in use by the key vault, which prevents me from. In order for us to add or update the Windows Azure pre-installed site extension, we will need a single zip package. The Azure Function will be deployed. KeyVault reference and function is. Azure Function App with Private Endpoint Secured Azure Storage . Both of the options are not working. Currently we just use one storage account for an Azure Function App. html ) discussion, and I see the following error: Image is no longer available. I followed this MS Document1 bicep code for setting Policies-Ftp to false and this MS Document2 bicep code for setting Policy-scm to false. The. Is there an existing issue for this? I have searched the existing issues; Community Note. Otherwise, you will get errors as described below: You signed in with another tab or window. Hi, AzureWebJobsStorage is OK, some problems with WEBSITE_CONTENTAZUREFILECONNECTIONSTRING, probably because WEBSITE_CONTENTSHARE is not present. My azure bicep code: @description ('The name of the Azure Function app. 582. you scope the nested template into different resource group than the parent one. From the official documentation:. I would recommend that you deploy the core Logic App service using Bicep. Find out the default values and examples of WEBSITE_CONTENTAZUREFILECONNECTIONSTRING and other settings related to the app environment, deployment, build automation, and more. check DNS zone and a record for. I'm running an Azure function on a linux premium plan (EP1). This is a big problem, because the slot name staging is the same for all our funcion apps. Microsoft. If WEBSITE_CONTENTSHARE and WEBSITE_CONTENTAZUREFILECONNECTIONSTRING app settings are set for Linux Consumption, the datarole will throw AzureFiles mounting blocked. 1 thought on “ Configure Logic Apps (Standard) with VNet and Private Endpoint ”. Step 4: Use Managed Identity for AzureWebJobsStorage. Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request; Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the. This was developed by someone in the past. It does not have to always be explicitly referenced. WEBSITE_CONTENTAZUREFILECONNECTIONSTRING from my application settings, which already has endpoint and key in hidden format. Deploying an Azure Function App with Bicep. I'm manually creating a storage with private endpoints and now somehow through my java code I want to make sure that my function. Or you can also change App Settings directly via REST API, or via PowerShell. You signed in with another tab or window. Often times, users reported the deployment either DevOps or ARM Template/EV2 with RunFromPackage failed intermittently or why my app didn't find the expected deployed content after a successful deployment or my function returned NotFound. But WEBSITE_CONTENTAZUREFILECONNECTIONSTRING was pointed to production, and. WebFaultException`1 [Microsoft. Choose Availability and Performance and select Web app down. Open up Visual Studio 2022 and choose the Create a new project option, select Azure in the platforms dropdown and then pick Azure Functions and click Next. With regard to this point, I created a Docker image and stored it in ACR. It could be due to the Terraform provider version. using alwayson: true in the properties/siteConfig config section. . { "name": "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING", "value": "[concat('DefaultEndpointsProtocol=parameters('storageAccountName')), '2019-06-01'). I am unable to change any code through the Azure portal as it says…Mar 6, 2021, 4:55 AM. Saved searches Use saved searches to filter your results more quickly Similar issue exists if the app is using KeyVault reference for AzureWebjobsStorage as well. I have a main bicep file and three bicep modules which are being used. Hi, I've deployed and published several Function Apps without issues over the last 12 months. Add "acrUseManagedIdentityCreds": true to the siteConfig in my ARM template; Assign the AcrPull role to the service principal of the functionapp (I've not tested this snippet because perms weren't set-up quite right and it's. Publishing works locally but not in CI/CD in azure devops. You might noticed that the last log is in May 6th and there is no more log since that. It's worth pointing out that App settings reference for Azure Functions states:. We provide our identities with role definitions that allow them to perform a certain list of allowed accounts. The function app works without those settings, so I am just left wondering what the mysterious problem is. 9' property under site config properties in your template to deploy function app running with python 3. And so all of the function apps' slots have the same value of WEBSITE_CONTENTSHARE = "staging. If above method is not working, it means that your current Production is not the original production when originally created but it is the original slot and swap to current production. You need to include the pythonVersion field also as shown:. Required Information Entering this information will route you directly to the right team and expedite traction. Stack Overflow Public questions & answers; Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers; Talent Build your employer brand ; Advertising Reach developers & technologists worldwide; Labs The future of collective knowledge sharing; About the companyNetworking overview of Logic Apps preview. ah, ok I see, you are trying to get reference from the Key Vault, not from the secret. Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request; Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the. Referencing, the new way. Thanks to that it will allow your Function App to have access to this storage and to work. You might need to check your access permissions or network configurations that could be preventing Kudu from starting up or accessing the necessary resources. The Function App uses the AzureWebJobsStorage and WEBSITE_CONTENTAZUREFILECONNECTIONSTRING app settings to connect to a private endpoint-secured Storage Account. This is going to be the secured storage account that your function app uses instead. In Azure, Managed Identities provide our Azure resources with an identity within Azure Active Directory. ite as your sitename. Hi, I ran into same issue today. Any settings/connection strings not marked as slot settings will be swapped with the app. Azure Functions is an event-driven, compute-on-demand experience that extends the existing Azure App Service application platform with capabilities to implement code triggered by events occurring in Azure, in third-party service, and in on-premises systems. It was handed over to me without any app settings. Because the WEBSITE_RUN_FROM_PACKAGE app setting is set, this. Hi all, I'm trying to create a new azure c# function, using templates from this ( creating-a-azure-python-or-c-function-dynamically. This post provisions with Bicep. This is where you can view and configure who has access to the resource. 0; It's even better if there is a possibility for DefaultAzureCredential from Azure. In this case, remove above two settings -- > Save. I'm using maven to create based azure function app. I agree to the comment and this SO Thread answer by @GordonBy. Asking for help, clarification, or responding to other answers. The only difference is that a connection string includes a. In the search box, search for and select Key Vault Application Settings Diagnostics. Feb 28, 2019 at 16:57. NET Azure Functions. WEBSITE_CONTENTAZUREFILECONNECTIONSTRING config is using @Microsoft. e. the key vault obviously doesn't have that property, because its not a secret, its a key vault. Creating Role Assignments. We are currently trying to deploy 3 functions to a linux app service plan. NET 6 isolated in the. I will add the settings to my resource creation script. 1 Blob storage is the default store for function keys, but you can configure an alternate store. You can refer to this document for operating system and language runtime support for the hosting plans. You switched accounts on another tab or window. Today let's get started and work through making a powershell function that can read. Hi @Steve Churcher , . If you are not the original author (seemano) and believe this issue is not stale, please comment with /bot not-stale and I. azure. Copy-and-paste the following settings: The bottom two settings are not straightforward at all. Add WEBSITE_CONTENTOVERVNET=1 setting in azure function app settings and then try. test. And you can find what you want: (My function name is 'openapifunctionbowman') Share. . Actual Behaviour We always get WEBSITE_CONTENTSHARE detected as a change even though the value is already present and the same. With an automatic approach via ARM, the recommended approach is to not set the WEBSITE_CONTENTSHARE app setting as it'll be auto-generated during ARM. 1 Azure Premium ASP plan Windows Host Hi, I hope this is the right repository for this issue. In the Azure portal, navigate to your funct. . You should have blob, file private endpoints in the same VNET where azure function is deployed. This is an example of a similar access for SignalR connection string: Endpoint= {signalr_service_endpoint};AuthType=aad;Version=1. Reload to refresh your session. Storage account. The @Microsoft. Hello When you create a Azure Function App with a App Service Plan in the consumption (D1) plan, the Function needs the application setting "WEBSITE. If choosing the Consumption hosting plan, your content is stored in Azure Files. So with hints taken from the other two answers and from here, I've devised two solutions. Remove WEBSITE_CONTENTAZUREFILECONNECTIONSTRING and WEBSITE_CONTENTSHARE appsettings when creating linux consumption function. Your app should be able to reach the Key Vault to resolve a reference successfully. Your logic app workflow generates information that can help you diagnose and debug problems in your app. Hi, I've tried to get an azure function app up and running with deployment slots using bicep templates. Check WEBSITE_SKIP_CONTENTSHARE_VALIDATION. func-app-1: : invalid orExpected Behaviour. Using a proper structure to segregate the code handled by the Infrastructure devops team and the developers writing code, it is possible to combine everything into ARM templates for deployment. resource "null_resource" "update_setting_consumption_plan" { provisioner "local-exec" { when = create interpreter = ["pwsh", "-command"] command = <<EOT sleep 30 az. In your scenario, as you have existing virtual network, which is different scope, the virtual network should be declared in separate module. . So far so now I have the following yaml: trigger: - none pr: - none pool: vmImage: "windows-latest"Thanks! that's very helpful. Tried to replicate the scenario and haven't faced any issues with the below code. With an automatic approach via ARM, the recommended approach is to not set the WEBSITE_CONTENTSHARE app setting as it'll be auto-generated during ARM. If it’s not installed, install it by running az bicep install in the console. It won't even let me update the settings to try to point it to a newly created st. On the subnet that the function app is integrated with, enable storage Service Endpoints. I have a function app attached to a storage account with 3 functions with timer triggers that randomly stopped working since last month. This is why in my template I have a specific parameter that sets the location for AppInsights instead of a standard entry of [resourceGroup(). I got following exception:. Oct 8, 2021, 7:48 AM. 63. appService. After the deployment slot is originally created, you will need to remove the setting. How can we create a re-deployable ARM template with these circular dependencies? Enter the value WEBSITE_RUN_FROM_PACKAGE for the Name, and paste the URL of your package in Blob Storage as the Value. Hello. Technical Information: . dependsOn exists to make sure that resources are created in the correct order. Option 1: Use 3 storage accounts. Not sure if it's directly related to the issue, but I suggest making your template more similar to what the Portal uses by default. For anyone that may have encountered this and scratched their heads because they didn't have nested JSON and had their <ItemGroup> values correct, this may help you. i am trying to create a function in azure porta .