azureazure-web-app-serviceazure-webjobsazure-managed-identity

Using Managed Identity to connect to a queue from a WebJob

I have an app service with a system-assigned managed identity, and a WebJob operating off a queue trigger. If I give the app service an AzureWebJobsStorage connection string, it works, no problem. It grabs the message from the queue and does its stuff. But that's less secure, and thus far I've been unable to get it to work off the managed identity.

I have it using the following settings to provide the info it needs:

AzureWebJobsStorage__accountName: [my storage account name]

AzureWebJobsStorage__credential: ManagedIdentity

It should have everything it needs to use the storage account name and the name of the queue set in the queue trigger (plus permissions to the storage account on the managed identity, I've given it Contributor, Key Vault Secrets User and Storage Queue Data Contributor) to listen to the queue. But it doesn't give any indication that it's doing so. It doesn't give an error, either. It just says "Job host started".

Oh, and I have AzureWebJobsDashboard set, since it seems to be necessary to use the dashboard, but clearly it doesn't use that to interact with the queue.

If it makes any difference, the app service is Windows.

My questions are thus:

  1. Is there something I'm missing that will get it working? Missing permissions, missing app settings, etc etc
  2. Will it even work as a WebJob? Everything I've seen online mentions Function apps, and while there's a lot of crossover, strictly speaking, it's a WebJob, not a Function app. At least it's not defined as such in the Azure Portal.
  3. If it won't work, what are the best alternatives? Previously we had connection strings coming from a Key Vault.
Solution

  • My appsettings.json file:

    {
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Azure.Core": "None"
    }
  }  
}

    Make sure you have set the LogLevel.

    enter image description here

    Thanks @techcommunity for the clear steps.

    I have taken references from this blog and followed the same for WebApp.

    enter image description here

    Storage Account Contributor
Storage Blob Data Owner
Storage Queue Data Contributor

    enter image description here

    enter image description here

    and run the Web Job

    enter image description here

    Output: enter image description here