Skip to content

Commit ad0de8c

Browse files
paulyukCopilot
andcommitted
docs: Add explicit UAMI configuration example for Blob Storage
Add User-assigned managed identity subsection with: - Table showing required properties (blobServiceUri, queueServiceUri, credential, clientId) - Complete JSON example for app settings Co-authored-by: Copilot <[email protected]>
1 parent 03f8ca1 commit ad0de8c

1 file changed

Lines changed: 25 additions & 0 deletions

File tree

includes/functions-storage-blob-connections.md

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,31 @@ The `serviceUri` form can't be used when the overall connection configuration i
4646

4747
Other properties may be set to customize the connection. See [Common properties for identity-based connections](../articles/azure-functions/functions-reference.md#common-properties-for-identity-based-connections).
4848

49+
#### User-assigned managed identity
50+
51+
To use a user-assigned managed identity, add the `credential` and `clientId` properties in addition to the service URI:
52+
53+
| Property | Environment variable template | Description | Example value |
54+
|---------------------------|-----------------------------------------------------|--------------------------------------------|---------|
55+
| Blob Service URI | `<CONNECTION_NAME_PREFIX>__blobServiceUri` | The data plane URI of the blob service. | `https://mystorageaccount.blob.core.windows.net` |
56+
| Queue Service URI | `<CONNECTION_NAME_PREFIX>__queueServiceUri` | The data plane URI of the queue service (required for blob triggers). | `https://mystorageaccount.queue.core.windows.net` |
57+
| Credential | `<CONNECTION_NAME_PREFIX>__credential` | Must be set to `managedidentity`. | `managedidentity` |
58+
| Client ID | `<CONNECTION_NAME_PREFIX>__clientId` | The client ID of the user-assigned managed identity. | `00000000-0000-0000-0000-000000000000` |
59+
60+
For example, if your binding configuration specifies `connection = "BlobStorageConnection"`, you would configure the following application settings:
61+
62+
```json
63+
{
64+
"BlobStorageConnection__blobServiceUri": "https://mystorageaccount.blob.core.windows.net",
65+
"BlobStorageConnection__queueServiceUri": "https://mystorageaccount.queue.core.windows.net",
66+
"BlobStorageConnection__credential": "managedidentity",
67+
"BlobStorageConnection__clientId": "00000000-0000-0000-0000-000000000000"
68+
}
69+
```
70+
71+
> [!TIP]
72+
> User-assigned managed identities are recommended for production scenarios where you need fine-grained control over identity permissions across multiple resources.
73+
4974
[!INCLUDE [functions-identity-based-connections-configuration](./functions-identity-based-connections-configuration.md)]
5075

5176
[!INCLUDE [functions-blob-permissions](./functions-blob-permissions.md)]

0 commit comments

Comments
 (0)