通过ARM模板添加VNET资源时遇LinkedAuthorizationFailed错误求助

错误原因分析 #

错误核心是订阅标识符使用错误：模板中用subscription().displayName（订阅显示名称）构造子网资源ID，但Azure资源ID要求必须用订阅ID（subscription().subscriptionId），导致系统无法定位到对应订阅，触发LinkedAuthorizationFailed错误。

同时模板还有两处潜在问题：

• serverFarmId直接使用应用服务计划名称，而非完整资源ID
• 引用虚拟网络时，reference返回整个对象，未提取其name属性

修正后的ARM模板 #

{
"contentVersion": "1.0.0.0",
"parameters": {
    "siteName": {
        "defaultValue": "defaultName",
        "type": "String",
        "metadata": {
            "description": "要创建的Function App名称"
        }
    },
    "storageAccountName": {
        "defaultValue": "defaultName",
        "type": "String",
        "metadata": {
            "description": "AzureWebJobsStorage对应的存储账户名称（需已存在）"
        }
    },
    "environment": {
        "defaultValue": "dev",
        "allowedValues": [
            "dev"
        ],
        "type": "String",
        "metadata": {
            "description": "目标环境"
        }
    },
    "location": {
        "defaultValue": "[resourceGroup().location]",
        "type": "String",
        "metadata": {
            "description": "物理位置，可保留默认值"
        }
    },
    "serviceAppPlan": {
        "defaultValue": "default",
        "type": "String",
        "metadata": {
            "description": "应用服务计划名称"
        }
    }
},
"resources": [
    {
        "type": "Microsoft.Web/sites",
        "apiVersion": "2022-09-01",
        "name": "[parameters('siteName')]",
        "location": "[parameters('location')]",
        "kind": "functionapp,linux",
        "properties": {
            "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('serviceAppPlan'))]",
            "virtualNetworkSubnetId": "[format('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Network/virtualNetworks/{2}/subnets/default', subscription().subscriptionId, resourceGroup().name, reference(resourceId('Microsoft.Network/virtualNetworks', format('{0}-myVnet', parameters('environment'))), '2020-11-01').name)]",
            "clientAffinityEnabled": false,
            "siteConfig": {
                "linuxFxVersion": "DOTNET|6.0",
                "alwaysOn": true,
                "ftpsState": "Disabled",
                "appSettings": [
                    {
                        "name": "AzureWebJobsStorage",
                        "value": "<存储账户连接字符串>"
                    },
                    {
                        "name": "APPLICATIONINSIGHTS_CONNECTION_STRING",
                        "value": "<应用洞察连接字符串>"
                    },
                    {
                        "name": "FUNCTIONS_EXTENSION_VERSION",
                        "value": "~4"
                    }
                ],
                "ipSecurityRestrictions": [
                    {
                        "vnetSubnetResourceId": "[format('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Network/virtualNetworks/{2}/subnets/default', subscription().subscriptionId, resourceGroup().name, format('{0}-myVnet', parameters('environment')))]",
                        "action": "Allow",
                        "tag": "Default",
                        "priority": 34,
                        "name": "[format('{0}-myVnet', parameters('environment'))]"
                    }
                ]
            }
        }
    }
]
}

关键修正点说明 #

• 替换订阅标识符：所有构造资源ID的位置，将subscription().displayName改为subscription().subscriptionId，确保Azure能正确识别目标订阅
• 应用服务计划资源ID：serverFarmId必须使用完整资源ID，通过resourceId('Microsoft.Web/serverfarms', parameters('serviceAppPlan'))生成
• 提取虚拟网络名称：reference返回虚拟网络完整对象，需通过.name属性提取名称，避免格式错误

内容的提问来源于stack exchange，提问作者Harry