How do I grant invocation access in Azure Function Apps?

Granting invocation access to Azure Function Apps involves configuring authorization levels, which control who can trigger or invoke your function. Here's a breakdown of how you can manage this:

1. Understanding Authorization Levels:

- Anonymous: Any user or service can invoke the function without needing an API key or authentication. This is suitable for public APIs.

- Function: An API key specific to the function is required to invoke it. This provides a moderate level of security.

- Admin: This level requires the master key for the function app, granting full access. It's mainly used for administration and should not be shared publicly.

- System: Only internal Azure processes can invoke the function, which is typically used for scenarios like Event Grid triggers.

2. Configuring Function App Authorization Settings:

- You can adjust the authorization level in the Azure portal:

- Navigate to your function app in the Azure portal.

- Select "Functions" under the "Functions" section.

- Choose the specific function.

- In the function's blade, navigate to "Function Keys" under the "Developer" section.

- Here you can manage API keys. The default key can be used with the 'Function' authorization level.

- Under the 'Code + Test' section of your function, you will have the URL that requires the key if authorization level is set to 'Function'.

- Alternatively, you can configure it via the `host.json` file, setting `authLevel` for the function triggers. For example:

{
  "version": "2.0",
  "extensions": {
    "http": {
      "routePrefix": "api",
      "authLevel": "function"
    }
  }
}

3. Using API Keys for Function Invocation:

- When the authorization level is set to `function`, you must include the function's API key in your invocation requests. This is typically done in the HTTP header (`x-functions-key`) or as a query parameter (code=YOUR_API_KEY).

- For example, a simple HTTP request may look like:

curl -X POST
"https://your-function-app.azurewebsites.net/api/your-function?code=YOUR_API_KEY"
-H "Content-Type: application/json"
-d '{"message": "Hello, World!"}'

4. Using Azure Active Directory (AAD) Authentication:

- For more advanced security, integrate your Function App with AAD. You would then use OAuth 2.0 access tokens for authentication, typically done with 'Easy Auth' in Azure portal.

5. Managing Access with Azure RBAC:

- For more granular control over function app resources, utilize Role-Based Access Control (RBAC) in Azure. This allows you to manage permissions for users and service principals on specific actions on the function app and its resources.

By carefully configuring the authorization levels and methods, you can effectively secure your Azure Function Apps and control invocation access.

Learn more about this