Azure Functions plus Service Bus with managed identity end to end

TL;DR: A queue-triggered function where the trigger, the host storage, and the code all authenticate with managed identity. No connection strings anywhere, including AzureWebJobsStorage. Enable system-assigned managed identity on the function app. Note its principal ID.

The fix

1. Identities. Enable system-assigned managed identity on the function app. Note its principal ID.

2. Roles. Assign:

   • Azure Service Bus Data Receiver (or Owner) on the Service Bus namespace, to the function identity.
   • Storage Blob Data Contributor + Storage Queue Data Contributor on the host storage account (the host needs queue/table/blob data access for its internals).
   • Storage Account Contributor is NOT enough for the host; it needs the data roles.
3. App settings (identity form).

[CONNECTION]__fullyQualifiedNamespace = [namespace].servicebus.windows.net
AzureWebJobsStorage__accountName = [storage-account]

The double-underscore fullyQualifiedNamespace pattern tells the extension to use identity. Remove any plain [CONNECTION] connection-string setting.

4. Function code (v2 model).

@app.service_bus_queue_trigger(arg_name="msg", queue_name="[queue]",
    connection="[CONNECTION]__fullyQualifiedNamespace")
def process(msg: func.ServiceBusMessage): ...

5. host.json with the extension bundle.

Traps:

• Mixing: a connection-string setting named [CONNECTION] alongside the identity one wins or confuses the binding. Delete the string version.
• The host storage data roles are the forgotten step; the trigger works but the host fails to start with storage errors.
• Local dev: func start uses your az login identity for the same settings; grant yourself the same roles on the dev namespace.

Verify: send a message to the queue, watch the invocation log in the portal, confirm no connection-string app settings exist.

When to use this

• This covers exactly what the title says: Azure Functions plus Service Bus with managed identity end to end.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Azure; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Proactive workflow skill. Identity-based trigger connection pattern verified against current Functions and Service Bus binding docs. Evidence: https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-service-bus-trigger