---
cuppy_hub: azure
cuppy_path: patterns/functions-keyless-host-storage.md
cuppy_section: docs
cuppy_doc: PPR1-VX8Q
cuppy_doc_uuid: 90ef943a-8d50-4e32-8a5e-ea68de7e6c1f
cuppy_permalink: https://cuppy.io/azure/d/PPR1-VX8Q
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/azure/docs/patterns/functions-keyless-host-storage
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: 00735184f0903abc46433deebb3168a649364af7cede8e404fd43d50cc345cf1
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Function app to its storage account without keys

**Host side:** the Functions host authenticates to its storage account as a managed identity, read from `AzureWebJobsStorage__*` settings. **Storage side:** the account lets that identity in on the network and grants it data roles. The app's own bindings are a **separate** connection with their own settings and roles, even on the same account.

## Known-good

- **Plan:** Flex Consumption or Dedicated (full identity support). Consumption and Elastic Premium still need a key for their Azure Files content share.
- **Identity:** one user-assigned identity on the app, its client ID in `AzureWebJobsStorage__clientId`, with `AzureWebJobsStorage__accountName` and `AzureWebJobsStorage__credential=managedidentity`. No `AzureWebJobsStorage` connection string anywhere, including slot settings.
- **Roles on the account:** Storage Blob Data Owner and Storage Table Data Contributor for the host; Storage Queue Data Contributor (or what the binding table lists) for the app's queues, through settings such as `OrdersQueue__queueServiceUri`.
- **Flex deployment package:** `functionAppConfig.deployment.storage` with `authentication.type: 'UserAssignedIdentity'` and a container that exists before the app.
- **Account:** `allowSharedKeyAccess: false`. If firewalled: VNet integration, and private endpoints for `blob`, `queue` and `table` with their private DNS zones linked to the app's VNet.
- **Created by Bicep, not `az functionapp create`** (`guides/functions/deploy-typescript-function.md`).

## Known-bad

| Configuration | Symptom |
|---|---|
| App created with `az functionapp create`, then Shared Key turned off | Portal `Azure Functions Runtime is unreachable`; host logs `KeyBasedAuthenticationNotPermitted`. The CLI stored a connection string |
| `__accountName` and `__credential` set, `__clientId` missing, only a user-assigned identity attached | The host can't get a token (no system-assigned identity to default to) |
| Identity has Storage Blob Data **Contributor**, not Owner | Host storage errors and failed coordination: Owner is the documented minimum |
| Table role missing | Warnings that diagnostic events can't be written; startup problems become invisible |
| App's queue binding reuses `AzureWebJobsStorage` as its connection | Microsoft says to define a separate connection for non-host components; mixing them couples app permissions to host permissions |
| Elastic Premium with Shared Key off and a content share | The app can't mount its Azure Files share; keep that one connection string in Key Vault or run without Azure Files |
| Account firewalled, app not VNet-integrated (or DNS zones not linked) | `AuthorizationFailure` from storage, or host start timeouts |
| Two apps with the same 32-character name prefix on one account | `AZFD0004` host ID collision; the host stops |

## Which side is wrong

- **No token / `ManagedIdentityCredential` errors in host logs** → the app: identity attached, `__clientId` correct (`reference/managed-identity/errors.md`).
- **`KeyBasedAuthenticationNotPermitted`** → the app still holds a connection string somewhere (`az functionapp config appsettings list -n <app> -g <rg> --query "[].name" -o tsv`).
- **403 `AuthorizationPermissionMismatch`** → the roles above, or propagation (10–30 minutes): `reference/storage/access-errors.md`.
- **403 `AuthorizationFailure` or timeouts** → the account's network: `reference/storage/network-and-firewall.md`.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->