Configure and deploy function apps

What this covers

Writing the function is half the job. You also choose a hosting plan that fits cold-start and memory needs, wire configuration and secrets without hard-coding them, give the app a managed identity instead of connection strings, and ship the code. This page covers the hosting plans, local project files, app settings, Key Vault references, identity-based connections and the deployment commands.

Exam weight: Connect to and consume Azure services (20–25%)

Skills measured

• "Configure and deploy function apps"

Key concepts

Hosting plans

Flex Consumption specifics: HTTP triggers scale together as one group; Blob (Event Grid-based) and Durable triggers form groups; every other function scales on its own. Deployment slots aren't supported (rolling updates are the zero-downtime option). The Blob trigger only supports the Event Grid source. You can't migrate an app in place to or from Flex; you create a new app and redeploy.

Project files

App settings

App settings are exposed to code as environment variables (os.environ["MODEL_ID"]) and are encrypted at rest. Required runtime settings include AzureWebJobsStorage (the host's storage) and, outside Flex, FUNCTIONS_WORKER_RUNTIME and FUNCTIONS_EXTENSION_VERSION. Flex Consumption moves the runtime, version and deployment settings into the site configuration, so don't set those as app settings there. Locally, AzureWebJobsStorage=UseDevelopmentStorage=true points at the Azurite emulator.

Key Vault references

Put a reference instead of the secret in an app setting:

• @Microsoft.KeyVault(SecretUri=https://<vault>.vault.azure.net/secrets/AiServiceKey/)
• @Microsoft.KeyVault(VaultName=<vault>;SecretName=AiServiceKey)

The app's managed identity needs Key Vault Secrets User. Versionless references pick up a rotated secret within 24 hours, or immediately on any config change. If resolution fails, the setting holds the literal reference string. For shared non-secret config, load Azure App Configuration with azure-appconfiguration-provider.

Identity-based connections

Replace connection strings with a setting prefix plus a suffix, then grant RBAC to the managed identity:

Deployment options

• func azure functionapp publish <app>: Core Tools builds remotely and deploys.
• az functionapp deployment source config-zip --src app.zip (add --build-remote true for Python on Flex).
• GitHub Actions (Azure/functions-action) or Azure Pipelines for CI/CD.
• Flex Consumption stores the package in a Blob container (by default in the AzureWebJobsStorage account, configurable with --deployment-storage-*).
• Premium and Dedicated: deploy to a staging slot and swap; mark environment-specific settings as slot settings.

How it works

Hands-on

Azure portal

1. Create a resource > Function App > Flex Consumption; pick Python 3.11 or later, a region, instance size 2,048 MB.
2. Under Settings > Identity, turn on the system-assigned identity.
3. Under Settings > Environment variables, add ServiceBusConnection__fullyQualifiedNamespace and a Key Vault reference setting; check the green Key vault reference status.
4. Under Scale and concurrency, set Always ready instances for http and the Maximum instance count.
5. For Premium apps, use Deployment slots and Swap.

Azure CLI

# Create storage account (required for Functions)
az storage account create --name <storage-account> --resource-group <resource-group> \
  --location eastus --sku Standard_LRS

# Flex Consumption function app (Python)
az functionapp create --name <app-name> --resource-group <resource-group> \
  --storage-account <storage-account> --flexconsumption-location eastus \
  --runtime python --runtime-version 3.11 --instance-memory 2048 \
  --always-ready-instances http=1

# Legacy Linux Consumption equivalent (retiring; shown for recognition)
# az functionapp create ... --consumption-plan-location eastus --runtime python \
#   --functions-version 4 --os-type Linux

# Scale settings
az functionapp scale config set -g <resource-group> -n <app-name> --maximum-instance-count 100
az functionapp scale config set -g <resource-group> -n <app-name> \
  --trigger-type http --trigger-settings perInstanceConcurrency=10

# Identity, settings and Key Vault reference
PRINCIPAL=$(az functionapp identity assign -g <resource-group> -n <app-name> --query principalId -o tsv)
az role assignment create --assignee $PRINCIPAL --role "Key Vault Secrets User" \
  --scope $(az keyvault show -n <vault> --query id -o tsv)
az functionapp config appsettings set -g <resource-group> -n <app-name> --settings \
  "ServiceBusConnection__fullyQualifiedNamespace=<namespace>.servicebus.windows.net" \
  "AI_KEY=@Microsoft.KeyVault(SecretUri=https://<vault>.vault.azure.net/secrets/AiServiceKey/)"

# Deploy
func azure functionapp publish <app-name>
# or
az functionapp deployment source config-zip -g <resource-group> -n <app-name> \
  --src app.zip --build-remote true

Python

import os
from azure.identity import DefaultAzureCredential
from azure.appconfiguration.provider import load

# App settings arrive as environment variables (Key Vault references already resolved)
model_id = os.environ["MODEL_ID"]
threshold = float(os.getenv("CONFIDENCE_THRESHOLD", "0.85"))
ai_key = os.environ["AI_KEY"]

# Shared, non-secret settings from Azure App Configuration
config = load(endpoint=os.environ["APP_CONFIG_ENDPOINT"],
              credential=DefaultAzureCredential(),
              selects=[{"key_filter": "AIBackend/*"}])
model_endpoint = config["AIBackend/ModelEndpoint"]

Pull cloud settings into local.settings.json with func azure functionapp fetch-app-settings <app-name> and protect them with func settings encrypt.

Exam traps

Quick review

• Flex Consumption is the recommended serverless plan: Linux, 512/2,048/4,096 MB, up to 1,000 instances.
• Premium keeps pre-warmed instances and supports slots and custom containers.
• local.settings.json is local only; app settings become environment variables in Azure.
• Key Vault references need a managed identity with Key Vault Secrets User.
• Identity-based connections use <prefix>__<property> settings plus RBAC.
• Deploy with func azure functionapp publish or az functionapp deployment source config-zip.
• AzureWebJobsStorage is always required by the host.

Practice

Practice: Function app configuration and deployment questions

Official references

• Understand Azure Functions hosting and scaling for AI workloads (unit)
• Manage secrets and configuration in Functions (unit)
• Configure identity and access for Functions (unit)
• Flex Consumption plan hosting
• Create and manage function apps in the Flex Consumption plan
• Use Key Vault references
• Identity-based connections
• Deployment technologies in Azure Functions