Azure Functions errors — runtime unreachable, host storage, AZFD events, Node.js v4 and CLI create failures
Why a function app won't start, deploy or show its functions — "Azure Functions Runtime is unreachable" and its storage causes (deleted, settings overwritten, keys rotated, firewall, Shared Key off with a connection string), AZFD events, identity-based host storage without its roles, Flex's 30-second start limit, Node.js v4 entry-point errors, and the Azure CLI's own create errors.
markdownreferencev1FFDY-C9BCstage: operatetrust: officialservice: functionsinterface: anyAzure Functions Runtime is unreachableAZFD0001AzureWebJobsStorage app setting is not present.AZFD0002Value of AzureWebJobsStorage app setting is invalid.AZFD0004 Host ID collisionAZFD0005AZFD0011 FUNCTIONS_WORKER_RUNTIME setting is requiredAZFD0013No job functions found.No HTTP triggers found.FUNCTIONS_NODE_BLOCK_ON_ENTRY_POINT_ERRORundici_1.Request is not a constructorFailed to detect the Azure Functions runtimeThe Function App has reached daily usage quotamanifest unknown function appStorage type is not allowedIt must have tablequeueand blob endpoints all enabledThe Consumption plan does not support storage accounts with network restrictions.has networking restrictions. No virtual networking was configured so your app will not start--configure-networking-laterusage error --runtime RUNTIME requiredFlex Consumption System.TimeoutException gRPCStorage Blob Data Owner AzureWebJobsStorageWEBSITE_CONTENTAZUREFILECONNECTIONSTRINGfunction app storage firewall
Azure Functions errors
A function app is a host that needs its own storage account (AzureWebJobsStorage) before it runs any code. Most "won't start" errors are that connection: missing, wrong, unreachable, or authenticated in a way the account refuses. Read the app's Diagnose and solve problems blade and Application Insights traces first; AZFD events land there even when the host can't start.
Host won't start
| Message / code | Cause → fix | Check |
|---|---|---|
Portal: Error: Azure Functions Runtime is unreachable. Click here for details on storage configuration. | The host can't reach its storage account: deleted, settings removed (often by a slot swap or an ARM script that replaced all settings), keys rotated under a connection string, firewall without a network path, or Shared Key turned off while the app still uses a connection string. Fix the cause below, then restart | az functionapp config appsettings list -n <app> -g <rg> --query "[].name" -o tsv (names only; never print values) |
AZFD0001 AzureWebJobsStorage app setting is not present. | Setting missing. Set either a connection string or the identity form (AzureWebJobsStorage__accountName + __credential + __clientId) | Same |
AZFD0002 Value of AzureWebJobsStorage app setting is invalid. | Not a valid connection string. Also raised for a Key Vault reference in that setting, where Microsoft says to suppress it | The value's shape (don't print it) |
| 403 from storage in host logs, identity form | The identity lacks Storage Blob Data Owner on the account (the minimum for the host). Add Storage Table Data Contributor too, or the host can't write diagnostic events. Blob triggers also need Storage Queue Data Contributor and Storage Account Contributor (reference/functions/hosting-and-host-storage.md) | az role assignment list --assignee <principal-id> --scope <storage-id> -o table |
KeyBasedAuthenticationNotPermitted in host logs | Shared Key is off and the app uses a connection string (the CLI writes one, see below). Switch to the identity form. Consumption and Elastic Premium still need a connection string for the Azure Files content share (WEBSITE_CONTENTAZUREFILECONNECTIONSTRING) | reference/storage/sas-and-key-errors.md |
Storage AuthorizationFailure / host timeouts with the account firewall on | No network path: VNet integration plus a VNet rule or private endpoints for blob, queue, table (and file on plans with a content share) | reference/storage/network-and-firewall.md |
AZFD0004 Host ID collision (error in v4: the host stops) | Two apps or slots share a storage account and the first 32 characters of their names. Use separate accounts, shorter names, or explicit host IDs | App names sharing a storage account |
AZFD0005 External startup exception | A .NET startup class threw during initialization; the host retries and logs it repeatedly | The exception's stack trace |
AZFD0011 The FUNCTIONS_WORKER_RUNTIME setting is required (warning); AZFD0013 runtime mismatch | The setting is missing, or doesn't match the deployed payload. Flex Consumption doesn't use this setting: the runtime is functionAppConfig.runtime | az functionapp config appsettings list … |
The Function App has reached daily usage quota and has been stopped until the next 24 hours time frame. | A daily quota you set was hit. Raise or remove it, then restart | Function App settings in the portal |
Flex Consumption: gRPC System.TimeoutException at start | App initialization exceeded 30 seconds (not configurable). Move slow work out of startup | Startup duration in traces |
Docker logs manifest unknown (container function apps) | The image or tag doesn't exist | reference/container-registry/errors.md |
| App unreachable from the portal only | Inbound access restrictions or an internal App Service Environment block the portal's calls to the app and Kudu | Access restrictions on the app |
Node.js (programming model v4)
| Message | Cause → fix | Check |
|---|---|---|
No job functions found. Try making your job classes and methods public. … / No HTTP triggers found. | The host loaded no registrations. Usually package.json main doesn't match the compiled files (TypeScript: dist/src/functions/*.js), the build didn't run before zipping, or an import threw at load. Set FUNCTIONS_NODE_BLOCK_ON_ENTRY_POINT_ERROR=true so entry-point errors surface. Needs runtime 4.25+, Core Tools 4.0.5382+ | Traces where message has "entry point" |
Exception: undici_1.Request is not a constructor | Node.js too old; use 22 or later | functionAppConfig.runtime.version or az functionapp config show |
WARNING: Failed to detect the Azure Functions runtime. Switching "@azure/functions" package to test mode … | An old applicationinsights dependency; use ^2.7.1 or later | package.json |
| HTTP streaming does nothing | Needs @azure/functions 4.3.0+, runtime 4.28+, and app.setup({ enableHttpStream: true }) | — |
Azure CLI az functionapp create errors (2.91, from its source)
| Message | Cause → fix |
|---|---|
Storage account '<name>' has no '<service>' endpoint. It must have table, queue, and blob endpoints all enabled | Host storage must be a general-purpose account (StorageV2), not Blob-only or Files-only |
Storage type <sku> is not allowed | The CLI accepts Standard_LRS, Standard_GRS, Standard_RAGRS, Standard_ZRS, Standard_GZRS, Premium_LRS only (not Standard_RAGZRS) |
The Consumption plan does not support storage accounts with network restrictions. … | Use Flex Consumption, Premium or Dedicated |
The storage account you selected "<name>" has networking restrictions. No virtual networking was configured so your app will not start. … | Pass --vnet and --subnet, or --configure-networking-later and add them before the app runs |
usage error: --runtime RUNTIME required for linux functions apps without custom image. | Pass --runtime node --runtime-version 22 (or 24) |
The CLI always lists the storage account's keys and writes a connection string into AzureWebJobsStorage. It needs listKeys on the account, and the app breaks once Shared Key is off. To create keyless, use Bicep (guides/functions/deploy-typescript-function.md) or switch the settings to the identity form right after create.