Using Azure Function's Managed Identity for Service Bus Output Bindings

This short post is intended to share experiences while working on the following scenario:

• Azure function with managed identity
• Output bindings configured for service bus queue

Although this may seem straightforward, we encountered some issues in making it work. The difficulties stemmed from the lack of clear documentation on this topic and the dependence on the package extension version used in the solution for service bus connectivity.

While it's commonly understood that a function app needs to define the connection string to the service bus, and this works well when the connection string contains the service bus's secret keys, questions arise when the function app needs to utilize its managed identity for communication with the service bus.

What's the solution?

In summary, sharing the required format for the connection string, which should be present either in your local.settings.json file or in the application configuration of the function app in the Azure portal.

Key takeaways:

• Note the double underscore in the setting's name; the suffix, 'fullyQualifiedNamespace,' signifies that the function app should utilize its managed identity for communication with the service bus. 
• When you define the setting in the above format, there's no need to specify the connection property in the output bindings of the attribute in your code. By default, the runtime will search for the connection string using this name i.e."AzureWebJobsServiceBus".
• If you have the connection name property initialized in your code, the key's name will change to 'yourconnectionnameusedincode__fullyQualifiedNamespace'

For additional reference, you can visit https://learn.microsoft.com/en-us/azure/azure-functions/functions-identity-based-connections-tutorial-2#connect-to-service-bus-in-your-function-app however, please note that the documentation can be somewhat tricky to understand and implement, which is why this post exists.

 

Hope this helps someone!