Question 108152 in Azure Question posted in
The official documentation to get you started can be found here.

MSINotEnabled – Can't use KeyVault Reference in Azure Function

I’m trying to use a User Assign Managed Identity to retrieve access in KeyVault reference in Azure Function.

enter image description here

I’m following this doc https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli#:~:text=you%20haven%27t%20already.-,Configure,-the%20app%20to to reference the keyvault in the application configuration.

I followed these steps:

  1. Created User Assign Managed Identity.

  2. Created a policy in Keyvault and gave permissions GET and LIST to User Assign Managed Identity.

  3. Set the User Assign Managed Identity in Azure Function Identity

  4. Set properties application setting like this:

  • mysecureapp – @Microsoft.KeyVault(SecretUri=https://mykv.vault.azure.net/secrets/mysecret/id)
  • keyVaultReferenceIdentity – /subscriptions/subsid/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/mgid

Any thoughts on this?

Tags:

4

Answers


  1. Chosen as BEST ANSWER
    0

    I realized that in addition to setting the property keyVaultReferenceIdentity via app-setting, we need to change this property of the same name in the resource function. The default value is SystemAssign if you enable it. Unfortunately the MS documentation is unclear on this.

    I found the property that can be used in the terraform documentation, follow the link: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#:~:text=key_vault_reference_identity_id

    After setting this property to the value of User Assign Managed Identity this worked fine.


  2. 0

    I hope you already done all the steps. But one thing you may missed i.e.,

    • you have to enable the system-assigned identity for your application.

    This error MSINotEnabled comes mostly during the absence of a managed Identity for your application, and it clearly says i.e., System assigned Managed identity.

    Refer to this medium article where we will find the troubleshooting steps had given along with all these kind of errors with resolutions were described.

    Login or Signup to reply.
  3. 0

    just found that when the keyVaultReferenceIdentity property is created in the Function using the portal our IaC (App Settings), it doesn’t recognize the User Assigned identity as the one to authenticate in KeyVault, but if you run the PATCH described in the following link using PowerShell, it works.

    https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-powershell#access-vaults-with-a-user-assigned-identity

    it should be enough to the reference to KeyVault works

    Login or Signup to reply.
  4. 0

    wow !

    I’m also searching the same topic for user identity and the same issue.
    I just followed the marked answer , its worked and able to retrieve the value.

    Thanks @ Magno Oliveira to bring this question to the community.

    just need to run the CLI command in azure portal ! give resource group name and useridentity name and function app name to the below command

    userAssignedIdentityResourceId=$(az identity show -g resourcegroupname -n manageidenityname --query id -o tsv)
appResourceId=$(az webapp show -g resourcegroupname -n functionappname --query id -o tsv)
az rest --method PATCH --uri "${appResourceId}?api-version=2021-01-01" --body "{'properties':{'keyVaultReferenceIdentity':'${userAssignedIdentityResourceId}'}}"
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search