Proposed Pull Request Change

📄 Document Links

View on GitHub View on Microsoft Learn

--- title: Create and Manage Function Apps in a Flex Consumption Plan description: "Learn how to create function apps hosted in the Flex Consumption plan in Azure Functions and how to modify specific settings for an existing function app." ms.service: azure-functions ms.date: 09/08/2026 ms.topic: how-to ms.custom: - build-2024 - devx-track-azurecli - devx-track-extended-java - devx-track-js - devx-track-python - devx-track-ts - ignite-2024 - build-2025 zone_pivot_groups: programming-languages-set-functions #customer intent: As an Azure developer, I want learn how to create and manage function apps in the Flex Consumption plan so that I can take advantage of the beneficial features of this plan. --- # Create and manage function apps in the Flex Consumption plan This article shows you how to create function apps hosted in the [Flex Consumption plan](./flex-consumption-plan.md) in Azure Functions. It also shows you how to manage certain features of a Flex Consumption plan hosted app. Function app resources are language-specific. Make sure to choose your preferred code development language at the beginning of the article. ## Prerequisites - An Azure account with an active subscription. If you don't already have one, you can [create an account for free](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn). - **[Azure CLI](/cli/azure/install-azure-cli)**: used to create and manage resources in Azure. When using the Azure CLI on your local computer, make sure to use version 2.60.0, or a later version. You can also use [Azure Cloud Shell](../cloud-shell/overview.md), which has the correct Azure CLI version. ::: zone pivot="programming-language-go" - For Go apps, use Azure CLI version `2.87.0` or later. Run `az version` to verify your installed version. ::: zone-end - **[Visual Studio Code](./functions-develop-vs-code.md)**: used to create and develop apps, create Azure resources, and deploy code projects to Azure. When using Visual Studio Code, make sure to also install the latest [Azure Functions extension](https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-azurefunctions). You can also install the [Azure Tools extension pack](https://marketplace.visualstudio.com/items?itemName=ms-vscode.vscode-node-azure-pack). - While not required to create a Flex Consumption plan app, you need a code project to be able to deploy to and validate a new function app. Complete the first part of one of these quickstart articles, where you create a code project with an HTTP triggered function: - [Create an Azure Functions project from the command line](how-to-create-function-azure-cli.md) - [Create an Azure Functions project using Visual Studio Code](how-to-create-function-vs-code.md) ::: zone pivot="programming-language-java" To create an app in a new Flex Consumption plan during a Maven deployment, you must create your local app project and then update the project's pom.xml file. For more information, see [Create a Java Flex Consumption app using Maven](#create-and-deploy-your-app-by-using-maven) ::: zone-end Return to this article after you create and run the local project, but before you're asked to create Azure resources. You create the function app and other Azure resources in the next section. ## Create a Flex Consumption app This section shows you how to create a function app in the Flex Consumption plan by using either the Azure CLI, Azure portal, or Visual Studio Code. For an example of creating an app in a Flex Consumption plan using Bicep/ARM templates, see the [Flex Consumption repository](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/README.md#iac-samples-overview). ::: zone pivot="programming-language-java" You can skip this section if you choose to instead [create and deploy your app using Maven](#create-and-deploy-your-app-by-using-maven). ::: zone-end To support your function code, you need to create three resources: - A [resource group](../azure-resource-manager/management/overview.md), which is a logical container for related resources. - A [Storage account](../storage/common/storage-account-create.md), which is used to maintain state and other information about your functions. - A function app in the Flex Consumption plan, which provides the environment for executing your function code. A function app maps to your local function project and lets you group functions as a logical unit for easier management, deployment, and sharing of resources in the Flex Consumption plan. ### [Azure CLI](#tab/azure-cli) [!INCLUDE [functions-flex-supported-regions-cli](../../includes/functions-flex-supported-regions-cli.md)] 3. Create a resource group in one of the currently supported regions listed by the command in the previous step. ```azurecli az group create --name <RESOURCE_GROUP> --location <REGION> ``` In the previous command, replace `<RESOURCE_GROUP>` with a value that's unique in your subscription and `<REGION>` with one of the currently supported regions. The [az group create](/cli/azure/group#az-group-create) command creates a resource group. 4. Create a general-purpose storage account in your resource group and region: ```azurecli az storage account create --name <STORAGE_NAME> --location <REGION> --resource-group <RESOURCE_GROUP> --sku Standard_LRS --allow-blob-public-access false ``` In the previous example, replace `<STORAGE_NAME>` with a name that's appropriate to you and unique in Azure Storage. Names must contain three to 24 characters consisting of numbers and lowercase letters only. `Standard_LRS` specifies a general-purpose account that Azure Functions supports according to [storage account requirements](storage-considerations.md#storage-account-requirements). The [az storage account create](/cli/azure/storage/account#az-storage-account-create) command creates the storage account. [!INCLUDE [functions-storage-access-note](../../includes/functions-storage-access-note.md)] 5. Create the function app in Azure: ::: zone pivot="programming-language-csharp" ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --flexconsumption-location <REGION> --runtime dotnet-isolated --runtime-version 8.0 ``` [C# apps that run in-process](./functions-dotnet-class-library.md) aren't currently supported when running in a Flex Consumption plan. ::: zone-end ::: zone pivot="programming-language-java" ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --flexconsumption-location <REGION> --runtime java --runtime-version 17 ``` ::: zone-end ::: zone pivot="programming-language-javascript,programming-language-typescript" ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --flexconsumption-location <REGION> --runtime node --runtime-version 22 ``` ::: zone-end ::: zone pivot="programming-language-python" ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --flexconsumption-location <REGION> --runtime python --runtime-version 3.11 ``` For Python apps, Python 3.10 is also currently supported. ::: zone-end ::: zone pivot="programming-language-powershell" ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --flexconsumption-location <REGION> --runtime powershell --runtime-version 7.6 ``` ::: zone-end ::: zone pivot="programming-language-go" ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --flexconsumption-location <REGION> --runtime go --runtime-version 1.0 --functions-version 4 az resource update --resource-group <RESOURCE_GROUP> --resource-type Microsoft.Web/sites --name <APP_NAME> --set properties.siteConfig.http20Enabled=false ``` The `az resource update` command disables HTTP/2 on the function app, which is required during the Go public preview. ::: zone-end In this example, replace both `<RESOURCE_GROUP>` and `<STORAGE_NAME>` with the resource group and the name of the account you used in the previous step, respectively. Also replace `<APP_NAME>` with a globally unique name appropriate to you. The `<APP_NAME>` is also the default domain name server (DNS) domain for the function app. The [`az functionapp create`] command creates the function app in Azure. The `az functionapp create` command creates a function app running in the Flex Consumption plan. Because you created the app without specifying [always ready instances](#set-always-ready-instance-counts), your app only incurs costs when actively executing functions. The command also creates an associated Azure Application Insights instance in the same resource group, with which you can monitor your function app and view logs. For more information, see [Monitor Azure Functions](functions-monitoring.md). ### [Azure portal](#tab/azure-portal) [!INCLUDE [functions-create-flex-consumption-app-portal-full](../../includes/functions-create-flex-consumption-app-portal-full.md)] ### [Visual Studio Code](#tab/vs-code) 1. Press F1, and in the command pallet enter **Azure Functions: Create function app in Azure...(Advanced)**. 1. If you're not signed in, you're prompted to **Sign in to Azure**. You can also **Create a free Azure account**. After signing in from the browser, go back to Visual Studio Code. 1. Following the prompts, provide this information: | Prompt | Selection | | ------ | ----------- | | Enter a globally unique name for the new function app. | Type a globally unique name that identifies your new function app and then select Enter. Valid characters for a function app name are `a-z`, `0-9`, and `-`. | | Select a hosting plan. | Choose **Flex Consumption**. | | Select a runtime stack. | Choose one of the supported language stack versions. | | Select a resource group for new resources. | Choose **Create new resource group** and type a resource group name, like `myResourceGroup`, and then select enter. You can also select an existing resource group. | | Select a location for new resources. | Select a location in a supported [region](https://azure.microsoft.com/regions/) near you or near other services that your functions access. Unsupported regions aren't displayed. | | Select a storage account. | Choose **Create new storage account** and at the prompt provide a globally unique name for the new storage account used by your function app and then select Enter. Storage account names must be between 3 and 24 characters long and can contain only numbers and lowercase letters. You can also select an existing account. | | Select an Application Insights resource for your app. | Choose **Create new Application Insights resource** and at the prompt provide the name for the instance used to store runtime data from your functions.| A notification appears after your function app is created. Select **View Output** in this notification to view the creation and deployment results, including the Azure resources that you created. --- ## Deploy your code project For deployment, Flex Consumption plan apps use a Blob storage container to host .zip package files that contain your project code and all libraries that are required for your app to run. For more information, see [Deployment](flex-consumption-plan.md#deployment). ::: zone pivot="programming-language-java" You can skip this section if you choose to instead [create and deploy your app using Maven](#create-and-deploy-your-app-by-using-maven). ::: zone-end You can choose to deploy your project code to an existing function app using various tools: ::: zone pivot="programming-language-go" Go deployment requires [Azure Functions Core Tools](functions-run-local.md#install-the-azure-functions-core-tools) version `4.12` or later. Run `func --version` to verify your installed version. ::: zone-end ### [Azure CLI](#tab/azure-cli-publish) You can use the Azure CLI to upload a deployment package file to the deployment share for a function app in Azure. To make this deployment, you must produce a .zip package file that can run when the package is mounted to your app. ::: zone pivot="programming-language-csharp,programming-language-java" This package file must contain all of the build output files and referenced libraries required for your project to run. ::: zone-end ::: zone pivot="programming-language-javascript,programming-language-typescript" For projects with a large number of libraries, package the root of your project file and request a [remote build]. ::: zone-end ::: zone pivot="programming-language-python" For Python projects, package the root of your project file and always request a [remote build]. Using a remote build prevents potential issues that can occur when you build a project on Windows to be deployed on Linux. ::: zone-end ::: zone pivot="programming-language-go" For Go projects, use Core Tools to create a ready-to-run .zip package locally, then deploy that package with the Azure CLI. Don't request a remote build for Go packages created by `func pack`. ::: zone-end ::: zone pivot="programming-language-csharp" 1. Using your preferred development tool, build the code project. 2. Create a .zip file that contains the output of the build directory. For more information, see [Project structure](dotnet-isolated-process-guide.md#project-structure). 3. When required, sign in to your Azure account and select the active subscription by using the [`az login`](/cli/azure/reference-index#az-login) command. ```azurecli az login ``` 4. Run the [`az functionapp deployment source config-zip`](/cli/azure/functionapp/deployment/source#az-functionapp-deployment-source-config-zip) command to deploy the application package located in the relative `<FILE_PATH>`. ```azurecli az functionapp deployment source config-zip --src <FILE_PATH> --name <APP_NAME> --resource-group <RESOURCE_GROUP> ``` ::: zone-end ::: zone pivot="programming-language-java" 1. Using your preferred development tool, build the code project. 2. Create a .zip file that contains the output of the build directory. For more information, see [Folder structure](./functions-reference-java.md#folder-structure). 3. When required, sign in to your Azure account and select the active subscription by using the [`az login`](/cli/azure/reference-index#az-login) command. ```azurecli az login ``` 4. Run the [`az functionapp deployment source config-zip`](/cli/azure/functionapp/deployment/source#az-functionapp-deployment-source-config-zip) command to deploy the application package located in the relative `<FILE_PATH>`. ```azurecli az functionapp deployment source config-zip --src <FILE_PATH> --name <APP_NAME> --resource-group <RESOURCE_GROUP> ``` ::: zone-end ::: zone pivot="programming-language-powershell" 1. Create a .zip file that contains the root directory of your code project. For more information, see [Folder structure](./functions-reference-powershell.md#folder-structure). 2. When required, sign in to your Azure account and select the active subscription by using the [`az login`](/cli/azure/reference-index#az-login) command. ```azurecli az login ``` 3. Run the [`az functionapp deployment source config-zip`](/cli/azure/functionapp/deployment/source#az-functionapp-deployment-source-config-zip) command to deploy the application package located in the relative `<FILE_PATH>`. ```azurecli az functionapp deployment source config-zip --src <FILE_PATH> --name <APP_NAME> --resource-group <RESOURCE_GROUP> ``` ::: zone-end ::: zone pivot="programming-language-javascript,programming-language-typescript" 1. Create a .zip file that contains the root directory of your code project. For more information, see [Folder structure](./functions-reference-node.md#folder-structure). 2. When required, sign in to your Azure account and select the active subscription by using the [`az login`](/cli/azure/reference-index#az-login) command. ```azurecli az login ``` 3. Run the [`az functionapp deployment source config-zip`](/cli/azure/functionapp/deployment/source#az-functionapp-deployment-source-config-zip) command to deploy the application package located in the relative `<FILE_PATH>`. ```azurecli az functionapp deployment source config-zip --src <FILE_PATH> --name <APP_NAME> --resource-group <RESOURCE_GROUP> --build-remote true ``` Make sure to set `--build-remote true` to perform a [remote build]. ::: zone-end ::: zone pivot="programming-language-python" 1. Create a .zip file that contains the root directory of your code project. For more information, see [Folder structure](./functions-reference-python.md#folder-structure). 2. When required, sign in to your Azure account and select the active subscription by using the [`az login`](/cli/azure/reference-index#az-login) command. ```azurecli az login ``` 3. Run the [`az functionapp deployment source config-zip`](/cli/azure/functionapp/deployment/source#az-functionapp-deployment-source-config-zip) command to deploy the application package located in the relative `<FILE_PATH>`. ```azurecli az functionapp deployment source config-zip --src <FILE_PATH> --name <APP_NAME> --resource-group <RESOURCE_GROUP> --build-remote true ``` Make sure to set `--build-remote true` to perform a [remote build]. ::: zone-end ::: zone pivot="programming-language-go" 1. In your root project folder, run this Core Tools command to build and package your Go project: ```console func pack ``` By default, the output .zip file has the same name as your project folder. 2. When required, sign in to your Azure account and select the active subscription using the [`az login`](/cli/azure/reference-index#az-login) command. ```azurecli az login ``` 3. Run the [`az functionapp deployment source config-zip`](/cli/azure/functionapp/deployment/source#az-functionapp-deployment-source-config-zip) command to deploy the package located in `<ZIP_FILE_PATH>`. ```azurecli az functionapp deployment source config-zip --resource-group <RESOURCE_GROUP> --name <APP_NAME> --src <ZIP_FILE_PATH> ``` ::: zone-end ### [Continuous Deployment](#tab/continuous-deployment) Azure Functions provides both a custom GitHub Action and a custom Azure Pipelines Task to support continuous deployment. To learn how to incorporate these tools into your CI/CD pipelines, see the following guides: - [Build and deploy using Azure Pipelines](./functions-how-to-azure-devops.md) - [Build and deploy using GitHub Actions](./functions-how-to-github-actions.md) ### [Core Tools](#tab/core-tools) [!INCLUDE [functions-publish-project-cli-clean](../../includes/functions-publish-project-cli-clean.md)] ### [Visual Studio Code](#tab/vs-code-publish) [!INCLUDE [functions-deploy-project-vs-code](../../includes/functions-deploy-project-vs-code.md)] --- ::: zone pivot="programming-language-java" ## Create and deploy your app by using Maven You can use Maven to create a Flex Consumption hosted function app and the required resources during deployment by modifying the `pom.xml` file. 1. Create a Java code project by completing the first part of one of these quickstart articles: - [Create an Azure Functions project from the command line](how-to-create-function-azure-cli.md?pivots=programming-language-java) - [Create an Azure Functions project using Visual Studio Code](how-to-create-function-vs-code.md?pivot=programming-language-java) 1. In your Java code project, open the `pom.xml` file and make these changes to create your function app in the Flex Consumption plan: - Change the value of `<properties>.<azure.functions.maven.plugin.version>` to `1.34.0`. - In the `<plugin>.<configuration>` section for the `azure-functions-maven-plugin`, add or uncomment the `<pricingTier>` element as follows: ```xml <pricingTier>Flex Consumption</pricingTier> ``` 1. (Optional) Customize the Flex Consumption plan in your Maven deployment by also including these elements in the `<plugin>.<configuration>` section: . - `<instanceSize>` - sets the [instance memory](./flex-consumption-plan.md#instance-sizes) size for the function app. The default value is `2048`. - `<maximumInstances>` - sets the highest value for the maximum instances count of the function app. - `<alwaysReadyInstances>` - sets the [always ready instance counts](flex-consumption-plan.md#always-ready-instances) with child elements for HTTP trigger groups (`<http>`), Durable Functions groups (`<durable>`), and other specific triggers (`<my_function>`). When you set any instance count greater than zero, you pay for these instances whether your functions execute or not. For more information, see [Billing](flex-consumption-plan.md#billing). 1. Before you can deploy, sign in to your Azure subscription by using the Azure CLI. ```azurecli az login ``` The [`az login`](/cli/azure/reference-index#az-login) command signs you into your Azure account. 1. Use the following command to deploy your code project to a new function app in Flex Consumption. ```console mvn azure-functions:deploy ``` Maven uses settings in the `pom.xml` template to create your function app in a Flex Consumption plan in Azure, along with the other required resources. If these resources already exist, the code is deployed to your function app, overwriting any existing code. ::: zone-end ::: zone pivot="programming-language-go" ## Create and deploy your Go app Go function apps are supported only on the Flex Consumption plan. To create, run, and deploy a Go function app, see [Create a Go function from the command line](how-to-create-function-azure-cli.md?pivots=programming-language-go). For Go-specific project structure and deployment details, see the [Go developer reference](functions-reference-go.md). ::: zone-end ## Configure virtual network integration You can enable [virtual network integration](functions-networking-options.md#virtual-network-integration) for your app in a Flex Consumption plan when you create your app or at a later time. Before you enable virtual network integration, review the networking behavior and subnet requirements specific to Flex Consumption. ### How Flex Consumption networking works Flex Consumption instances don't each use a unique IP address from the subnet you integrate the app with. Instead, a pool of platform-managed network gateways (internal to the Flex Consumption infrastructure) uses IP addresses from the subnet to serve all apps integrated with that subnet. This IP multiplexing architecture is fundamentally different from Premium plans, where each instance uses one IP address from the subnet. The *40 IPs per app* guideline ensures there are enough IP addresses for the platform gateway pool and other infrastructure components but it's not an enforced limit. Plan for this minimum when sizing your subnet, but understand that actual IP consumption is typically lower. The platform dynamically allocates IPs from the shared gateway pool as apps integrated with the subnet scale out. ### Subnet sizing and requirements Choose an appropriately sized subnet for your Flex Consumption apps. The following table provides guidance based on your scenario: | Scenario | Recommended CIDR | Usable IPs | Notes | | ------ | ------ | ------- | ------- | | Single Flex app | `/27` | 27 | Minimum supported subnet size for one app | | Multiple Flex apps in one subnet | `/26` | 59 | Recommended when hosting multiple apps and for high-scale workloads (1,000+ instances); provides adequate gateway capacity | #### Subnet delegation - Delegate the subnet to `Microsoft.App/environments`. This delegation differs from Premium and Dedicated plans, which use `Microsoft.Web/serverFarms`. - [Register](../azure-resource-manager/management/resource-providers-and-types.md#register-resource-provider) the `Microsoft.App` resource provider in your subscription. #### Subnet usage restrictions - The subnet can't already be used for private endpoints or service endpoints, and it can't be delegated to other hosting plans or services. - You can't share the same subnet between an Azure Container Apps environment and a Flex Consumption app. - Subnet names can't contain underscore (`_`) characters, which is a current limitation of the Flex Consumption plan. #### Subnet sharing - You can share the same subnet with more than one app running in a Flex Consumption plan. However, because networking resources are shared across all apps, one function app can affect the performance of others on the same subnet. Consider the aggregate demand when packing multiple apps into a small subnet. - The subnet and app must be in the same region. #### IP allocation and planning - Flex Consumption apps don't assign a unique IP address to each instance. Instead, a pool of network gateways uses IP addresses from the subnet. The guideline of reserving 40 IPs per app helps ensure there are sufficient IP addresses for the gateway pool and other infrastructure components, but actual usage is typically lower. - A `/27` subnet (27 usable IPs) is sufficient for a single app supporting up to 1,000 instances due to IP multiplexing. For multiple apps or high-scale workloads, use a `/26` subnet to provide adequate gateway capacity. - When many apps share a subnet and many scale out with significant outbound traffic, outbound network throughput can become a bottleneck rather than IP addresses being exhausted. Evaluate performance at your planned production scale. ### Enable virtual network integration when you create the app The examples in this section assume that your account already contains a [virtual network and subnet](../virtual-network/quick-create-cli.md#create-a-virtual-network-and-subnet). #### [Azure CLI](#tab/azure-cli) Enable virtual network integration by running the [`az functionapp create`] command and including the `--vnet` and `--subnet` parameters. The subnet must be delegated to `Microsoft.App/environments` and must be at least `/27` in size. For more information, see [Subnet sizing and requirements](#subnet-sizing-and-requirements). 1. [Create the virtual network and subnet](../virtual-network/quick-create-cli.md#create-a-virtual-network-and-subnet), if you don't have one already. 1. Complete steps 1-4 in [Create a Flex Consumption app](#create-a-flex-consumption-app) to create the resources required by your app. 1. Run the [`az functionapp create`] command, including the `--vnet` and `--subnet` parameters, as in this example: ::: zone pivot="programming-language-go" ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --flexconsumption-location <REGION> --runtime go --runtime-version 1.0 --functions-version 4 --vnet <VNET_RESOURCE_ID> --subnet <SUBNET_NAME> az resource update --resource-group <RESOURCE_GROUP> --resource-type Microsoft.Web/sites --name <APP_NAME> --set properties.siteConfig.http20Enabled=false ``` The `az resource update` command disables HTTP/2 on the function app, which is required during the Go public preview. ::: zone-end ::: zone pivot="programming-language-csharp,programming-language-java,programming-language-javascript,programming-language-powershell,programming-language-python,programming-language-typescript" ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --flexconsumption-location <REGION> --runtime <RUNTIME_NAME> --runtime-version <RUNTIME_VERSION> --vnet <VNET_RESOURCE_ID> --subnet <SUBNET_NAME> ``` ::: zone-end The `<VNET_RESOURCE_ID>` value is the resource ID for the virtual network, which is in the format: `/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>`. You can use this command to get a list of virtual network IDs, filtered by `<RESOURCE_GROUP>`: `az network vnet list --resource-group <RESOURCE_GROUP> --output tsv --query "[]".id`. #### [Azure portal](#tab/azure-portal) Use these steps to create your function app with virtual network integration and related Azure resources. [!INCLUDE [functions-create-flex-consumption-app-portal](../../includes/functions-create-flex-consumption-app-portal.md)] 6. In the **Networking** tab, set **Enable public access** to **Off** and **Enable network injection** to **On**. 7. For **Virtual network**, select or create a virtual network that is in the same region as your app. 8. Set **Enable VNet integration** to **On** and select or create a subnet. 9. Select **Review - create** to review the app configuration you chose, and then select **Create** to provision and deploy the function app with virtual networking. 10. Select the **Notifications** icon in the upper-right corner of the portal and watch for the **Deployment succeeded** message. 11. Select **Go to resource** to view your new function app. You can also select **Pin to dashboard**. Pinning makes it easier to return to this function app resource from your dashboard. #### [Visual Studio Code](#tab/vs-code) You can't currently enable virtual networking when you use Visual Studio Code to create your app. --- For end-to-end examples of how to create apps in Flex Consumption with virtual network integration, see these resources: - [Flex Consumption: HTTP to Event Hubs using virtual network integration](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/README.md) - [Flex Consumption: triggered from Service Bus using virtual network integration](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/README.md) ### Modify or remove virtual network integration You can add, change, or remove virtual network integration for an existing app. #### [Azure CLI](#tab/azure-cli) Use the [`az functionapp vnet-integration add`](/cli/azure/functionapp/vnet-integration#az-functionapp-vnet-integration-add) command to enable virtual network integration to an existing function app: ```azurecli az functionapp vnet-integration add --resource-group <RESOURCE_GROUP> --name <APP_NAME> --vnet <VNET_RESOURCE_ID> --subnet <SUBNET_NAME> ``` Use the [`az functionapp vnet-integration remove`](/cli/azure/functionapp/vnet-integration#az-functionapp-vnet-integration-remove) command to disable virtual network integration in your app: ```azurecli az functionapp vnet-integration remove --resource-group <RESOURCE_GROUP> --name <APP_NAME> ``` Use the [`az functionapp vnet-integration list`](/cli/azure/functionapp/vnet-integration#az-functionapp-vnet-integration-list) command to list the current virtual network integrations for your app: ```azurecli az functionapp vnet-integration list --resource-group <RESOURCE_GROUP> --name <APP_NAME> ``` #### [Azure portal](#tab/azure-portal) You can integrate your existing app with an existing virtual network and subnet in the portal. 1. In your function app page in the [Azure portal], expand **Settings** in the left menu and select **Networking**. 1. Under **Outbound traffic configuration**, select **Not configured**. 1. In the **Virtual Network Integration** page, select **Add virtual network integration**. 1. Select an existing **Virtual network** and **Subnet** and select **Connect**. #### [Visual Studio Code](#tab/vs-code) You can't currently configure virtual networking in Visual Studio Code. --- ### Troubleshoot networking issues with Application Insights [Application Insights](./functions-monitoring.md) is the first place to look when a Flex Consumption app shows DNS failures, dependency timeouts, or other connectivity symptoms. It captures what your code observed at runtime: exceptions, outbound dependency calls, and end-to-end execution behavior. This helps you distinguish application-level failures from underlying platform or network issues. The following Application Insights tables are most useful for networking investigations: | Table | What it shows | Use it for | | --- | --- | --- | | `traces` | Runtime, host, `ILogger`, and scale-controller logs. On Flex Consumption, deployment initialization details also appear here. | Host startup problems, cold start behavior, deployment failures, and DNS failures that surface through host or dependency logs. | | `requests` | One entry per HTTP invocation, with duration, result code, and success. | High-latency HTTP triggers, 4xx and 5xx failures, and confirming that the app is receiving and serving requests. | | `exceptions` | Runtime and user exceptions, including stack traces. | Root-cause investigation for DNS, Azure Storage, Azure Key Vault, module-not-found, timeout, and similar runtime failures. | | `dependencies` | Outgoing HTTP, SQL, Service Bus, and other dependency calls, with timing and failure codes. | "Works locally but fails on Flex Consumption" symptoms, and DNS, TLS, or authentication failures on outbound calls caused by virtual network, DNS, or NAT behavior. | | `customMetrics` | Aggregated metrics such as duration and success or failure counts. | Trend analysis, sudden drops in success rate, and spikes in duration that indicate scaling or stuck executions. | | `FunctionAppLogs` (resource log) | Platform-level function app logs sent to Azure Monitor Logs. | When Application Insights data is missing or incomplete, or for control-plane and host-level issues such as binding failures. | | `AzureActivity` | Control-plane operations such as start, stop, sync triggers, delete, and list keys. | Auditing configuration changes and diagnosing trigger registration issues (sync trigger failures are common). | #### Example queries Use these starter queries in the **Logs** experience of your Application Insights resource. Replace `<APP_NAME>` with the name of your function app. Host startup or deployment failures (Flex Consumption specific): ```kusto traces | where timestamp > ago(1d) | where cloud_RoleName == "<APP_NAME>" | where message contains "Starting" or message contains "host" | project timestamp, message, customDimensions | order by timestamp desc ``` HTTP trigger issues, latency, or 5xx errors: ```kusto requests | where timestamp > ago(1h) | where cloud_RoleName == "<APP_NAME>" | project timestamp, name, resultCode, duration, success, url, operation_Name | order by timestamp desc ``` Common exceptions grouped by type, such as DNS, Key Vault, Storage, or language-runtime modules: ```kusto exceptions | where timestamp > ago(1d) | where cloud_RoleName == "<APP_NAME>" | summarize count() by type, innermostMessage | order by count_ desc ``` Outbound dependency failures (DNS, TLS, authentication, virtual network routing): ```kusto dependencies | where timestamp > ago(2h) | where cloud_RoleName == "<APP_NAME>" | where success == false | project timestamp, target, resultCode, duration, type, data ``` Non-HTTP trigger that isn't firing (queue, blob, or Event Grid triggers). A common cause is that the trigger registration succeeded but the listener didn't enable; the related exceptions appear in scale-controller traces: ```kusto traces | where timestamp > ago(2h) | where message contains "listener" or message contains "trigger" ``` ### Troubleshoot network performance When a Flex Consumption app integrates with a subnet smaller than the recommended size, you might experience performance degradation as the app scales. This problem can also happen if you integrate many apps with the same subnet when they scale out and have significant outbound traffic. #### Symptoms of undersized subnets Monitor for these symptoms, which indicate that outbound capacity rather than IP addresses is the limiting factor: - Increased latency on outbound calls to dependencies - Connection timeouts to external services - These issues increase as the app scales up, not as a sudden outage > [!IMPORTANT] > Scale-out itself isn't blocked by subnet size. The app continues to add instances even if the subnet is undersized. Performance degradation occurs instead of a hard scale limit. #### Monitoring and mitigation - **Instrument Application Insights with outbound dependency latency metrics**: where this metric provides an early warning signal for undersized subnets. - **Load-test at production scale before settling on subnet size** to validate that your subnet sizing can handle your expected workload. - **Monitor with Azure Monitor**: Go to **Virtual Network** > **Subnet** in Azure Monitor to see IP allocation data via Azure Resource Graph and KQL queries. - **Right-size your subnet** according to the guidance in the previous section. A `/27` minimum is strongly recommended; a `/26` is recommended for multiple apps. > [!NOTE] > Use at least a `/27` subnet to ensure adequate platform stability. Subnets significantly smaller than `/27` might experience gateway creation problems with no explicit error message. ## Configure deployment settings In the Flex Consumption plan, an Azure Blob Storage container holds the deployment package with your app's code. By default, deployments use the same storage account (`AzureWebJobsStorage`) and connection string that the Functions runtime uses to maintain your app. The `DEPLOYMENT_STORAGE_CONNECTION_STRING` application setting stores the connection string. However, you can designate a blob container in a separate storage account as the deployment source for your code. You can also change the authentication method used to access the container. A customized deployment source should meet these criteria: - The storage account must already exist. - The container to use for deployments must also exist. - When more than one app uses the same storage account, each app should have its own deployment container. Using a unique container for each app prevents deployment packages from being overwritten, which would happen if apps shared the same container. When you configure deployment storage authentication, keep these considerations in mind: - As a security best practice, use managed identities when connecting to Azure Storage from your apps. For more information, see [Connections](./manage-connections.md). - When you use a connection string to connect to the deployment storage account, the application setting that contains the connection string must already exist. - When you use a user-assigned managed identity, you link the provided identity to the function app. You also assign the `Storage Blob Data Contributor` role scoped to the deployment storage account to the identity. - When you use a system-assigned managed identity, you create an identity when a valid system-assigned identity doesn't already exist in your app. When a system-assigned identity exists, you assign the `Storage Blob Data Contributor` role scoped to the deployment storage account to the identity. To configure deployment settings when you create your function app in the Flex Consumption plan: ### [Azure CLI](#tab/azure-cli) Use the [`az functionapp create`] command and supply these extra options that customize deployment storage: | Parameter | Description | | --- | --- | | `--deployment-storage-name` | The name of the deployment storage account. | | `--deployment-storage-container-name` | The name of the container in the account to contain your app's deployment package. | | `--deployment-storage-auth-type`| The authentication type to use for connecting to the deployment storage account. Accepted values include `StorageAccountConnectionString`, `UserAssignedIdentity`, and `SystemAssignedIdentity`. | | `--deployment-storage-auth-value` | When using `StorageAccountConnectionString`, set this parameter to the name of the application setting that contains the connection string to the deployment storage account. When you set `UserAssignedIdentity`, set this parameter to the name of the resource ID of the identity you want to use. | This example creates a function app in the Flex Consumption plan with a separate deployment storage account and user assigned identity: ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --runtime dotnet-isolated --runtime-version 8.0 --flexconsumption-location "<REGION>" --deployment-storage-name <DEPLOYMENT_ACCOUNT_NAME> --deployment-storage-container-name <DEPLOYMENT_CONTAINER_NAME> --deployment-storage-auth-type UserAssignedIdentity --deployment-storage-auth-value <MI_RESOURCE_ID> ``` ### [Azure portal](#tab/azure-portal) You can't currently configure deployment storage when creating your app in the Azure portal. To configure deployment storage during app creation, use Azure CLI to create your app. You can use the portal to modify the deployment settings of an existing app, as detailed in the next section. ### [Visual Studio Code](#tab/vs-code) You can't currently configure deployment storage when creating your app in Azure using Visual Studio Code. --- You can also modify the deployment storage configuration for an existing app. ### [Azure CLI](#tab/azure-cli) Use the [`az functionapp deployment config set`](/cli/azure/functionapp/deployment/config#az-functionapp-deployment-config-set) command to modify the deployment storage configuration. ```azurecli az functionapp deployment config set --resource-group <RESOURCE_GROUP> --name <APP_NAME> --deployment-storage-name <DEPLOYMENT_ACCOUNT_NAME> --deployment-storage-container-name <DEPLOYMENT_CONTAINER_NAME> ``` ### [Azure portal](#tab/azure-portal) 1. In your function app page in the [Azure portal], expand **Settings** in the left menu and select **Deployment settings**. 1. Under **Application package location**, select an existing **Storage account** and then select an existing empty **container** in the account. 1. Under **Storage authentication**, select your preferred authentication type: - When you select **Connection string**, select the name of the app setting that contains the connection string for the deployment storage account. - When you select **User assigned identity**, select the identity you want to use. 1. Select **Save** to update the app. ### [Visual Studio Code](#tab/vs-code) You can't currently configure deployment storage for your app in Azure by using Visual Studio Code. --- ## Configure instance memory Set the instance memory size for your Flex Consumption plan when you create your app. For more information about supported sizes, see [Instance sizes](flex-consumption-plan.md#instance-sizes). To set an instance memory size that's different from the default when creating your app: ### [Azure CLI](#tab/azure-cli) Specify the `--instance-memory` parameter in your [`az functionapp create`] command. This example creates a C# app with an instance size of `4096`: ```azurecli az functionapp create --instance-memory 4096 --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --flexconsumption-location <REGION> --runtime dotnet-isolated --runtime-version 8.0 ``` ### [Azure portal](#tab/azure-portal) When you create your app in a Flex Consumption plan in the Azure portal, choose your instance memory size in the **Instance size** field in the **Basics** tab. For more information, see [Create a Flex Consumption app](#create-a-flex-consumption-app). ### [Visual Studio Code](#tab/vs-code) You can't currently control the instance memory size when you use Visual Studio Code to create your app. The default size is used. --- At any point, you can change the instance memory size setting used by your app. ### [Azure CLI](#tab/azure-cli) This example uses the [`az functionapp scale config set`](/cli/azure/functionapp/scale/config#az-functionapp-scale-config-set) command to change the instance memory size setting to 512 MB: ```azurecli az functionapp scale config set --resource-group <resourceGroup> --name <APP_NAME> --instance-memory 512 ``` ### [Azure portal](#tab/azure-portal) 1. In your function app page in the [Azure portal], expand **Settings** in the left menu and select **Scale and concurrency**. 1. Select an **Instance memory** option and select **Save** to update the app. ### [Visual Studio Code](#tab/vs-code) You can't currently change the instance memory size setting for your app by using Visual Studio Code. --- ## Set always ready instance counts Set a specific number of always ready instances for the [Per-function scaling](flex-consumption-plan.md#per-function-scaling) groups or individual functions, to keep your functions loaded and ready to execute. Three special groups exist, as in per-function scaling: - `http` - All of the HTTP triggered functions in the app scale together into their own instances. - `durable` - All of the Durable triggered functions (Orchestration, Activity, Entity) in the app scale together into their own instances. - `blob` - All of the blob (Event Grid) triggered functions in the app scale together into their own instances. Use `http`, `durable`, or `blob` as the name for the name value pair setting to configure always ready counts for these groups. For all other functions in the app, configure always ready for each individual function by using the format `function:<FUNCTION_NAME>=n`. ### [Azure CLI](#tab/azure-cli) To define one or more always ready instance designations, use the `--always-ready-instances` parameter with the [`az functionapp create`] command. This example sets the always ready instance count for all HTTP triggered functions to `10`: ::: zone pivot="programming-language-csharp,programming-language-java,programming-language-javascript,programming-language-powershell,programming-language-python,programming-language-typescript" ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --runtime <LANGUAGE_RUNTIME> --runtime-version <RUNTIME_VERSION> --flexconsumption-location <REGION> --always-ready-instances http=10 ``` ::: zone-end ::: zone pivot="programming-language-go" ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --runtime go --runtime-version 1.0 --functions-version 4 --flexconsumption-location <REGION> --always-ready-instances http=10 az resource update --resource-group <RESOURCE_GROUP> --resource-type Microsoft.Web/sites --name <APP_NAME> --set properties.siteConfig.http20Enabled=false ``` The `az resource update` command disables HTTP/2 on the function app, which is required during the Go public preview. ::: zone-end ::: zone pivot="programming-language-csharp,programming-language-java,programming-language-javascript,programming-language-powershell,programming-language-python,programming-language-typescript" This example sets the always ready instance count for all Durable trigger functions to `3` and sets the always ready instance count to `2` for a service bus triggered function named `function5`: ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --runtime <LANGUAGE_RUNTIME> --runtime-version <RUNTIME_VERSION> --flexconsumption-location <REGION> --always-ready-instances durable=3 function:function5=2 ``` ::: zone-end ::: zone pivot="programming-language-go" This example sets the always ready instance count to `2` for a Service Bus triggered function named `function5`: ```azurecli az functionapp create --resource-group <RESOURCE_GROUP> --name <APP_NAME> --storage-account <STORAGE_NAME> --runtime go --runtime-version 1.0 --functions-version 4 --flexconsumption-location <REGION> --always-ready-instances function:function5=2 az resource update --resource-group <RESOURCE_GROUP> --resource-type Microsoft.Web/sites --name <APP_NAME> --set properties.siteConfig.http20Enabled=false ``` The `az resource update` command disables HTTP/2 on the function app, which is required during the Go public preview. ::: zone-end ### [Azure portal](#tab/azure-portal) You can't currently define always ready instances when creating your app in the Azure portal. To define always ready instances during app creation, use the Azure CLI to create your app. You can use the portal to modify always ready instances on an existing app, as detailed in the next section. ### [Visual Studio Code](#tab/vs-code) You can't currently define always ready instances when creating your app in Azure using Visual Studio Code. --- You can also modify always ready instances on an existing app by adding or removing instance designations or by changing existing instance designation counts. ### [Azure CLI](#tab/azure-cli) This example uses the [`az functionapp scale config always-ready set`](/cli/azure/functionapp/scale/config/always-ready#az-functionapp-scale-config-always-ready-set) command to change the always ready instance count for the HTTP triggers group to `10`: ```azurecli az functionapp scale config always-ready set --resource-group <RESOURCE_GROUP> --name <APP_NAME> --settings http=10 ``` To remove always ready instances, use the [`az functionapp scale config always-ready delete`](/cli/azure/functionapp/scale/config/always-ready#az-functionapp-scale-config-always-ready-delete) command, as in this example that removes all always ready instances from both the HTTP triggers group and also a function named `hello_world`: ```azurecli az functionapp scale config always-ready delete --resource-group <RESOURCE_GROUP> --name <APP_NAME> --setting-names http function:hello_world ``` ### [Azure portal](#tab/azure-portal) 1. In your function app page in the [Azure portal], expand **Settings** in the left menu and select **Scale and concurrency**. 1. Under **Always-ready instance minimum**, type `http`, `blob`, `durable`, or a specific function name using the format `function:<FUNCTION_NAME>=n` in **Trigger** and type the **Number of always-ready instances**. 1. Select **Save** to update the app. ### [Visual Studio Code](#tab/vs-code) You can't currently modify always ready instances by using Visual Studio Code. --- ## Set HTTP concurrency limits If you don't set specific limits, the system determines HTTP concurrency defaults for Flex Consumption plan apps based on your instance size setting. For more information, see [HTTP trigger concurrency](functions-concurrency.md#http-trigger-concurrency). Here's how you set HTTP concurrency limits for an existing app: ### [Azure CLI](#tab/azure-cli) Use the [`az functionapp scale config set`](/cli/azure/functionapp/scale/config#az-functionapp-scale-config-set) command to set specific HTTP concurrency limits for your app, regardless of instance size. ```azurecli az functionapp scale config set --resource-group <RESOURCE_GROUP> --name <APP_NAME> --trigger-type http --trigger-settings perInstanceConcurrency=10 ``` This example sets the HTTP trigger concurrency level to `10`. After you set an HTTP concurrency value, the app maintains that value despite any changes in your app's instance size setting. ### [Azure portal](#tab/azure-portal) 1. In your function app page in the [Azure portal], expand **Settings** in the left menu and select **Scale and concurrency**. 1. Under **Concurrency per instance**, select **Assign manually** and type a specific limit. 1. Select **Save** to update the app. ### [Visual Studio Code](#tab/vs-code) You can't currently set HTTP concurrency limits by using Visual Studio Code. --- ## Set site update strategy The Flex Consumption plan uniquely supports two different site update strategies that control how your function app handles code deployments and configuration changes. By default, Flex Consumption plan apps use the `Recreate` strategy, which terminates currently executing functions during deployments. To enable zero-downtime deployments, you can configure the `RollingUpdate` strategy instead. For more information, see [Site update strategies in Flex Consumption](flex-consumption-site-updates.md). > [!NOTE] > Site update strategy configuration is currently in public preview and is only available through Bicep or ARM templates. You can't configure this setting by using the Azure CLI, Azure portal, or Visual Studio Code. ### [Azure CLI](#tab/azure-cli) The Azure CLI doesn't currently support site update strategy configuration. Use Bicep or ARM templates as described in [Configure site update strategy](flex-consumption-site-updates.md#configure-your-update-strategy). ### [Azure portal](#tab/azure-portal) The Azure portal doesn't currently support site update strategy configuration. Use Bicep or ARM templates as described in [Configure site update strategy](flex-consumption-site-updates.md#configure-your-update-strategy). ### [Visual Studio Code](#tab/vs-code) Visual Studio Code doesn't currently support site update strategy configuration. Use Bicep or ARM templates as described in [Configure site update strategy](flex-consumption-site-updates.md#configure-your-update-strategy). --- ## Configure end-to-end TLS encryption End-to-end (E2E) TLS encryption encrypts traffic between the Azure platform front ends and the workers that run your functions. Enable E2E TLS encryption by setting the `endToEndEncryptionEnabled` site property to `true` in an ARM or Bicep template. For more information about how E2E TLS encryption protects traffic, see [End-to-end TLS encryption in Azure App Service](../app-service/overview-tls.md#end-to-end-tls-encryption). ## Configure site-scoped certificates Flex Consumption introduces site-scoped certificates, a new model where TLS/SSL certificates are scoped to your individual function app rather than shared across apps in the same webspace. The following table shows the supported certificate types and how each one is added to your function app: | Certificate type | How to add | Counts toward | | --- | --- | --- | | [App Service Managed Certificate](../app-service/configure-ssl-certificate.md#create-a-free-managed-certificate) | Created in the portal for a custom domain | Private certificate limit | | [App Service certificate](../app-service/configure-ssl-app-service-certificate.md) | Purchased through Azure, then imported | Private certificate limit | | [Certificate imported from Key Vault](../app-service/configure-ssl-certificate.md#import-a-certificate-from-key-vault) | Imported from Azure Key Vault | Private certificate limit | | Uploaded private certificate (.pfx) | [Uploaded as a PFX file](#add-a-certificate) | Private certificate limit | | Uploaded public certificate (.cer) | [Uploaded as a CER file](#add-a-certificate) | Public certificate limit | ### Considerations for site-scoped certificates - Existing apps created before this feature became available don't currently have a migration path for certificates. To use site-scoped certificates, create a new Flex Consumption function app. - Azure CLI support for managing site-scoped certificates isn't yet available. In the meantime, use the [Azure portal](https://portal.azure.com) or [ARM/Bicep templates](functions-infrastructure-as-code.md?pivots=flex-consumption-plan#site-scoped-certificates) to manage certificates. - Each app supports a maximum of three private certificates and three public certificates. - Private certificates must be exported as a [password-protected PFX file](https://en.wikipedia.org/w/index.php?title=X.509&section=4#Certificate_filename_extensions) that contains all intermediate certificates and the root certificate in the certificate chain. - Elliptic Curve Cryptography (ECC) certificates are supported when uploaded as a PFX. - Because Flex Consumption runs on Linux, your code must load certificates from file paths rather than from the Windows certificate store. First, follow the steps in [Make a certificate accessible to your code](#make-a-certificate-accessible-to-your-code) to load certificates into the runtime environment. Then, for guidance on reading certificate files from your application code, see [Load certificates in Linux/Windows containers](../app-service/configure-ssl-certificate-in-code.md#load-certificates-in-linuxwindows-containers). ### Add a certificate You can add certificates to your app in several ways, depending on the certificate type. Add free managed and Azure certificates directly in the portal. Select one of the following tabs to see how to add a managed, private (.pfx), public (.cer), or Key Vault-managed certificate. #### [Bind managed certificate](#tab/managed-cert) To create and bind a free managed certificate for a custom domain: 1. In the [Azure portal](https://portal.azure.com/), go to your function app. 1. In the left menu, expand **Settings** and select **Custom domains**. 1. Select **Add custom domain**. 1. Under **TLS/SSL certificate**, select **App Service Managed Certificate**. 1. Under **TLS/SSL type**, select **SNI SSL**. 1. Complete the domain validation and select **Add**. The managed certificate is created and bound to the custom domain automatically. It might take up to 10 minutes for the certificate to be issued. #### [Upload private (.pfx)](#tab/private-pfx) To upload a custom private certificate that you obtained: 1. Get a certificate from your own certificate provider. 1. Export the certificate as a [password-protected PFX file](https://en.wikipedia.org/w/index.php?title=X.509&section=4#Certificate_filename_extensions). Include all intermediate certificates in the chain. 1. In the [Azure portal](https://portal.azure.com/), go to your function app. 1. In the left menu, expand **Settings** and select **Certificates**. 1. Select **Bring your own certificates (.pfx)** > **+ Add certificate**. 1. Under **Source**, select **Upload certificate (.pfx)**. 1. Select your .pfx file and enter the certificate password. 1. Provide a **Certificate friendly name** for identification. 1. Select **Validate**, and then select **Add**. After the operation finishes, the certificate appears in the **Bring your own certificates (.pfx)** list. #### [Import from Key Vault](#tab/key-vault) If you use [Azure Key Vault](/azure/key-vault/general/overview) to manage your certificates, you can import a PKCS12 certificate from Key Vault into your function app. > [!IMPORTANT] > For better security, use a managed identity to authenticate to Key Vault instead of a service principal. To grant Key Vault access to a managed identity: 1. [Enable a managed identity](../app-service/overview-managed-identity.md) for your function app if you haven't already: ```azurecli az functionapp identity assign \ --resource-group <RESOURCE_GROUP> \ --name <APP_NAME> ``` 1. Grant the managed identity the **Key Vault Certificate User** role on your key vault by using RBAC. This approach is recommended over access policies (legacy): ```azurecli # Get the principal ID of the managed identity principalId=$(az functionapp identity show \ --resource-group <RESOURCE_GROUP> \ --name <APP_NAME> \ --query principalId -o tsv) # Assign Key Vault Certificate User role az role assignment create \ --role "Key Vault Certificate User" \ --assignee "$principalId" \ --scope "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.KeyVault/vaults/<KEY_VAULT_NAME>" ``` > [!NOTE] > If your key vault is configured to disable public access, make sure to select **Allow trusted Microsoft services to bypass this firewall** so that the Azure Functions platform can access the vault. For more information, see [Key Vault firewall-enabled trusted services only](/azure/key-vault/general/network-security#key-vault-firewall-enabled-trusted-services-only). To import the certificate from your vault: 1. In the [Azure portal](https://portal.azure.com/), go to your function app. 1. In the left menu, expand **Settings** and select **Certificates**. 1. Select **Bring your own certificates (.pfx)** > **+ Add certificate**. 1. Under **Source**, select **Import from Key Vault**. 1. Select **Select key vault certificate**, and then choose the **Subscription**, **Key Vault**, and **Certificate**. 1. After you finish with your selection, choose **Select** > **Validate**, and then select **Add**. After the operation finishes, the certificate appears in the **Bring your own certificates (.pfx)** list. > [!NOTE] > When you update your certificate in a Key Vault entry, the platform background job automatically syncs the updated certificate to your function app within 24 hours. #### [Upload public (.cer)](#tab/public-cer) Public certificates are supported in the `.cer` format. Upload a public certificate to your function app when your code needs to access remote services that require certificate authentication. 1. In the [Azure portal](https://portal.azure.com/), go to your function app. 1. In the left menu, expand **Settings** and select **Certificates**. 1. Select **Public key certificates (.cer)** > **+ Add certificate**. 1. Select your `.cer` file and provide a **Certificate friendly name**. 1. Select **Add**. --- ### Make a certificate accessible to your code After adding a certificate, you must explicitly make it accessible to your function code. 1. In the [Azure portal](https://portal.azure.com/), go to your function app. 1. In the left menu, expand **Settings** and select **Certificates**. 1. Select **Bring your own certificates (.pfx)** or **Public key certificates (.cer)**. 1. Select **...** (ellipsis) next to the certificate you want to make accessible, and then choose **Make accessible to app code**. When you enable **Accessible to app code**, the platform loads the certificate into the runtime environment on all instances as a file. Certificate files are named by thumbprint and placed in these directories: | Certificate type | Path | | --- | --- | | Public certificates (.cer) | `/var/ssl/certs` | | Private certificates (.pfx) | `/var/ssl/private` | ### Renew or update a certificate Free managed certificates are automatically renewed by the platform. For all other certificates, how you update an expiring certificate depends on the certificate source: - **Certificates imported from Key Vault**: When you renew a certificate in Key Vault, the platform background job automatically syncs the updated certificate to your function app within 24 hours. The new certificate version is loaded to all instances without any manual steps. - **Uploaded certificates**: Upload the new certificate, and then make it accessible to your app code. If your code references the certificate by thumbprint, update any thumbprint references in your code or app settings. ## View currently supported regions To view the list of regions that currently support Flex Consumption plans, see: [!INCLUDE [functions-flex-supported-regions-cli](../../includes/functions-flex-supported-regions-cli.md)] When you create an app in the [Azure portal](flex-consumption-how-to.md?tabs=azure-portal#create-a-flex-consumption-app) or by using [Visual Studio Code](flex-consumption-how-to.md?tabs=vs-code#create-a-flex-consumption-app), the region list excludes currently unsupported regions. ## Monitor your app in Azure Azure Monitor provides these distinct sets of metrics to help you better understand how your function app runs in Azure: - Platform metrics: provides infrastructure-level insights - Application Insights: provides code-level insights, including traces and error logs. If you [enable Application Insights in your app](configure-monitoring.md#enable-application-insights-integration), you can: - Track detailed execution times and dependencies - Monitor individual function performance - Analyze failures and exceptions - Correlate platform metrics with application behavior by using custom queries For more information, see [Monitor Azure Functions](monitor-functions.md). ### Supported metrics Run this script to view all of the platform metrics that are currently available for your app: ```azurecli appId=$(az functionapp show --name <APP_NAME> --resource-group <RESOURCE_GROUP> --query id -o tsv) az monitor metrics list-definitions --resource $appId --query "[].{Name:name.localizedValue,Value:name.value}" -o table ``` In this example, replace `<RESOURCE_GROUP>` and `<APP_NAME>` with your resource group and function app names. This script gets the fully qualified app ID and returns the available platform metrics in a table. ### View metrics You can review current metrics either in the Azure portal or by using the Azure CLI. In the Azure portal, you can also create metrics alerts and pin charts and other reports to dashboards in the portal. ### [Azure CLI](#tab/azure-cli) Use this script to generate a report of the current metrics for your app: ```azurecli appId=$(az functionapp show --name <APP_NAME> --resource-group <RESOURCE_GROUP> --query id -o tsv) echo -e "\nAlways-ready and on-demand execution counts..." az monitor metrics list --resource $appId --metric "AlwaysReadyFunctionExecutionCount" --interval PT1H --output table az monitor metrics list --resource $appId --metric "OnDemandFunctionExecutionCount" --interval PT1H --output table echo -e "\nExecution units (MB-ms) in always-ready and on-demand execution counts..." az monitor metrics list --resource $appId --metric "AlwaysReadyFunctionExecutionUnits" --interval PT1H --output table az monitor metrics list --resource $appId --metric "OnDemandFunctionExecutionUnits" --interval PT1H --output table echo -e "\nAlways-ready resource utilization..." az monitor metrics list --resource $appId --metric "AlwaysReadyUnits" --interval PT1H --output table echo -e "\nMemory utilization..." az monitor metrics list --resource $appId --metric "AverageMemoryWorkingSet" --interval PT1H --output table az monitor metrics list --resource $appId --metric "MemoryWorkingSet" --interval PT1H --output table echo -e "\nInstance count and CPU utilization..." az monitor metrics list --resource $appId --metric "InstanceCount" --interval PT1H --output table az monitor metrics list --resource $appId --metric "CpuPercentage" --interval PT1H --output table ``` ### [Azure portal](#tab/azure-portal) 1. In your function app page in the [Azure portal], select **Monitoring** > **Metrics**. If the current chart is blank, select **+ Add metric**. 1. With your app as the **Scope**, choose one or more of the supported **Metric** options to add to the current chart. 1. Repeat the previous step to add other metrics to the chart. 1. (Optional) Select **Save to dashboard** to add the current chart to a new or existing dashboard. Remember to include both always-ready and on-demand metrics for broad visibility. 1. (Optional) Select **New alert rule** to create an alert on a specific metric. Remember to include both always-ready and on-demand metrics for broad visibility. ### [Visual Studio Code](#tab/vs-code) You can't currently review and set metrics by using Visual Studio Code. --- To learn more about metrics for Azure Functions, see [Monitor Azure Functions](monitor-functions.md). ### View logs When you connect your app to Application Insights, you can better analyze your app performance and troubleshoot problems during execution. In the Application Insights resource for your app: - Use **Performance** to analyze response times and dependencies. - Use **Failures** to identify any errors that occur after migration. - Create custom queries in **Logs** to analyze function behavior. For example, use this query to compare success rates by instance: Use this query to compare success rates by instance: ```kusto requests | where timestamp > ago(7d) | summarize successCount=countif(success == true), failureCount=countif(success == false) by bin(timestamp, 1h), cloud_RoleName | render timechart ``` Use this query to analyze the number of instances that are actively processing your function: ```kusto let _startTime = ago(20m); //Adjust start time as needed let _endTime = now(); //Adjust end time as needed let bins = 1s; //Adjust bin as needed - this will give per second results requests | where operation_Name == 'EventHubsTrigger' //Replace with the name of the function in the function app that you are analyzing | where timestamp between(_startTime .. _endTime) | make-series dcount(cloud_RoleInstance) default=0 on timestamp from _startTime to _endTime step bins | render columnchart ``` ### View costs Because you can tune your app to adjust performance versus operating costs, it's important to track the costs associated with running your app in the Flex Consumption plan. To view the current costs: 1. In your function app page in the [Azure portal], select the resource group link. 1. In the resource group page, select **Cost Management** > **Cost analysis**. 1. Review the current costs and cost trajectory of the app itself. 1. Optionally, select **Cost Management** > **Alerts** and then **+ Add** to create a new alert for the app. ## Fine-tune your app The Flex Consumption plan provides several settings that you can tune to refine the performance of your app. Actual performance and costs can vary based on your app-specific workload patterns and configuration. For example, higher [memory instance sizes](./flex-consumption-plan.md#instance-sizes) can improve performance for memory-intensive operations but at a higher cost per active period. Here are some adjustments you can make to fine-tune performance versus cost: - [Adjust concurrency settings](./functions-concurrency.md) to maximize throughput per instance. - [Choose the appropriate memory size](#configure-instance-memory) for your workload. Higher memory sizes cost more but can improve performance. ## Related content - [Azure Functions Flex Consumption plan hosting](flex-consumption-plan.md) - [Azure Functions hosting options](functions-scale.md) [`az functionapp create`]: /cli/azure/functionapp#az-functionapp-create [remote build]: ./functions-deployment-technologies.md#remote-build [Azure portal]: https://portal.azure.com