title: Securing an Azure Function
body: <p>I'm trying to apply the least privilege principle to an Azure Function. What I want is to make a FunctionApp have only read access to a, for example, storage queue. What I've tried so far is:</p>
  
  <ul>
  <li>Enable managed identity in the FunctionApp</li>
  <li>Create a role that only allows read access to the queues (role definition below)</li>
  <li>Go to the storage queue IAM permissions, and add a new role assignment, using the new role and the Function App.</li>
  </ul>
  
  <p>But it didn't work. If I try to write to that queue from my function (using an output binding) the item is written, when I expected a failure. I've tried using the builtin role "Storage Queue Data Reader (Preview)" with the same result.</p>
  
  <p>What's the right way to add/remove permissions of a Function App? </p>
  
  <p>Role definition:</p>
  
  <pre><code>{
    "Name": "Reader WorkingSA TestQueue Queue",
    "IsCustom": true,
    "Description": "Read TestQueue queue on WorkingSA storage accoung.",
    "actions": ["Microsoft.Storage/storageAccounts/queueServices/queues/read"],
    "dataActions": [
      "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read"
    ],
    "notActions": [],
    "notDataActions": [],
    "AssignableScopes": [
      "/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/TestAuth-dev-rg"
    ]
  }
  </code></pre>