Azure Function应用运行时添加连接设置及修改应用设置方法咨询

Nice question! Let's walk through how you can dynamically create and update connection settings for your Azure Function while it's running—since you already know the basics of local bindings, portal/CLI setup, this fills in the runtime gap.

First off, remember that Azure Function app settings (including connection strings) are tied to the underlying App Service resource. So you can't just tweak a local file to update cloud-hosted settings at runtime—you'll need to use Azure's Resource Manager (ARM) tools or APIs to make changes directly to the cloud resource.

核心实现思路 #

To add new connection settings on the fly, you'll need two key pieces:

• Permissions: Let your Function app access and modify its own App Service settings
• Runtime code: Use Azure's management SDK (or REST API) to programmatically update the settings

具体步骤&代码示例 #

1. Set Up Permissions #

First, grant your Function app the right access:

• Enable system-assigned managed identity for your Function app (in the Azure portal, go to Identity > System assigned > Turn on)
• Assign the Website Contributor role to this identity, scoped to either your Function app's resource group or the app itself. This gives the app just enough permission to update its own settings without overprivileging.

2. Use the Azure Management SDK (Example in .NET) #

Since you mentioned using .NET class libraries, here's a practical code snippet to add a dynamic connection string:

First, install the required NuGet packages:

Install-Package Azure.ResourceManager.AppService
Install-Package Azure.Identity

Then, add this logic to your Function:

using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.AppService;
using Azure.ResourceManager.AppService.Models;

public static async Task Run([TimerTrigger("0 */5 * * * *")] TimerInfo myTimer, ILogger log)
{
    log.LogInformation("Starting to add dynamic connection setting...");

    // Initialize ARM client using the Function's system-assigned identity
    var armClient = new ArmClient(new DefaultAzureCredential());

    // Replace these with your actual resource details
    string subscriptionId = "your-subscription-id";
    string resourceGroupName = "your-resource-group-name";
    string functionAppName = "your-function-app-name";

    // Get a reference to your Function app resource
    var subscription = await armClient.GetSubscriptionAsync(subscriptionId);
    var resourceGroup = await subscription.GetResourceGroupAsync(resourceGroupName);
    var functionApp = await resourceGroup.GetSiteAsync(functionAppName);

    // Fetch current app settings
    var currentAppSettings = await functionApp.GetSiteAppSettingsAsync();
    var settingsDict = currentAppSettings.Value.Properties;

    // Define your new connection string (use the "ConnectionStrings:" prefix for standard connection strings)
    string newConnKey = "ConnectionStrings:MyDynamicDBConnection";
    string newConnValue = "Server=tcp:your-db-server.database.windows.net,1433;Initial Catalog=your-db;User ID=your-user;Password=your-password;Encrypt=True;";

    // Add or update the setting
    settingsDict[newConnKey] = newConnValue;

    // Push the updated settings back to Azure
    var updateOptions = new SiteAppSettingsPatch { Properties = settingsDict };
    await functionApp.UpdateSiteAppSettingsAsync(updateOptions);

    log.LogInformation($"Successfully added/updated connection: {newConnKey}");
}

3. Key Things to Keep in Mind #

• App Restart: Updating app settings will automatically restart your Function app. This will kill any in-flight executions, so plan this for low-traffic periods or use deployment slots to minimize downtime.
• Sensitive Data: Azure automatically encrypts stored app settings, so you don't have to worry about exposing connection strings in your code (just don't log them!).
• Local Testing: When running locally, DefaultAzureCredential uses your local Azure CLI/login identity—make sure that account has the same Website Contributor permissions to test the logic.

Alternative: Use the ARM REST API #

If you prefer not to use the SDK, you can call the ARM REST API directly. Here's a sample request:

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{functionAppName}/config/appsettings?api-version=2023-01-01
Authorization: Bearer {access-token}
Content-Type: application/json

{
  "properties": {
    "ConnectionStrings:MyDynamicConnection": "your-connection-string-value"
  }
}

You'll need to fetch a valid access token using your Function's managed identity to authenticate the request.

内容的提问来源于stack exchange，提问作者Evan Park