I have created a sample Blob and Queue Trigger function in the Azure Portal using an App Service Plan and added the below environment variables in the App Settings to successfully work with Managed Identity.

BASHCopied
AzureWebJobsStorage__blobServiceUri : https://<storageName>.blob.core.windows.net/
AzureWebJobsStorage__credential : managedidentity
AzureWebJobsStorage__queueServiceUri : https://<storageName>.queue.core.windows.net/
AzureWebJobsStrorage__accountName : <storageName>

I have added the Storage Account Contributor, Storage Blob Data Owner and Storage Queue Data Contributor roles to the function app in the storage account.

Blob Trigger Function :

CSHARPCopied
public static void Run(Stream myBlob, string name, ILogger log)
{
    log.LogInformation($"C# Blob trigger function Processed blob\n Name:{name} \n Size: {myBlob.Length} Bytes");
}

Queue Trigger Function :

CSHARPCopied
using System;

public static void Run(string myQueueItem, ILogger log)
{
    log.LogInformation($"C# Queue trigger function processed: {myQueueItem}");
}

Output :

I successfully got the output for the Blob and Queue trigger functions in the Azure Function App using Managed Identity.

It could be a problem with the internal sync and the caching of the underlying access tokens used by the communication.
Unfortunately, there is currently no way to reload the authorizations. So it can take up to 24 hours to be resolved :)

https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq#are-managed-identities-tokens-cached

(confirmed working, you can skip to Third try to see final solution)

First try

let me give it a try. question, did you add both below in the app setting for AzureWebJobsStorage?

JSONCopied
"AzureWebJobsStorage__accountName": "rgbeta18230",  
"AzureWebJobsStorage__credential": " managedidentity",  

I have created the exact func app based on your description, blob trigger in storage account rgbeta18230blob and AzureWebJobs in rgbeta18230.

test1: using AzureWebJobsStorage with connection string, trigger works.

test2: removed AzureWebJobsStorage and added "AzureWebJobsStorage__accountName": "rgbeta18230" only, getting the same error as yours:

test3: further added "AzureWebJobsStorage__credential": " managedidentity", trigger works again.

In short, AzureWebJobsStorage__credential is needed to tell the FA to use managedidentity. leaving it out will not use managedidentity. Please give it a try.

My c# func app host.json below:

Second try

refer to this link, https://docs.azure.cn/en-us//azure-functions/functions-reference?tabs=blob&pivots=programming-language-csharp, under Grant permission to the identity.

The AzureWebJobsStorage connection is used internally for blobs and queues that enable the trigger. If it's configured to use an identity-based connection, it needs extra permissions beyond the default requirement. The required permissions are covered by the Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Account Contributor roles.

I also checked my working FA's rabc on the storage account, these 3 roles are assigned. Also tried to take out Storage Account Contributor , the FA gave same error.

additional information from github repo: Regarding the Storage Account Contributor, that should only be needed if you are using a blob trigger, I believe. The account metadata needs to be read to handle the $logs collection used for managing the trigger state.

https://github.com/Azure/azure-functions-host/issues/8135#issuecomment-1040879695
https://github.com/Azure/Azure-Functions/issues/2189

Third try

Second try has resolved FA permission issue however the blob trigger still fails. further research shows more RBAC is need and also app setting. paste my full configuration below that works for FA and trigger.

1- RABC for rgbeta18230

this is for AzureWebJobsStorage, please add Storage Queue Data Contributor

this Storage Queue Data Contributor is to resolve this error in app insight

2- RABC for rgbeta18230blob

this is blob trigger

3- App setting for FA

please add the BlobStoragen_queueServiceUri