Quickstart: Connect Azure Functions to databases and services with Service Connector

2025-08-19

Get started with Service Connector to connect your Azure Functions to databases, storage accounts, and other Azure services. Service Connector simplifies authentication and configuration, enabling you to connect to resources using managed identities or other authentication methods.

This article provides step-by-step instructions for both the Azure portal and Azure CLI. Choose your preferred method using the tabs above.

Prerequisites

An Azure account with an active subscription. Create an account for free.
A function app in a region supported by Service Connector. If you don't have one yet, create one.
A target resource to connect your function app to, such as a Blob Storage account.
The necessary permissions to create and manage service connections.

An Azure account with an active subscription. Create an account for free.
A function app in a region supported by Service Connector. If you don't have one yet, create one.
A target resource to connect your function app to, such as a Blob Storage account.
The permissions required to create and manage service connections.

Use the Bash environment in Azure Cloud Shell. For more information, see Get started with Azure Cloud Shell.
If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.
- If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Authenticate to Azure using Azure CLI.
- When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use and manage extensions with the Azure CLI.
- Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

This quickstart requires version 2.30.0 or higher of the Azure CLI. To upgrade to the latest version, run az upgrade. If using Azure Cloud Shell, the latest version is already installed.

Set up your environment

If you're using Service Connector for the first time, register the Service Connector resource provider by running the az provider register command.
```
az provider register -n Microsoft.ServiceLinker
```
Tip

You can check if the resource provider has already been registered by running the command az provider show -n "Microsoft.ServiceLinker" --query registrationState. If the output is Registered, then Service Connector has already been registered.
Optionally, run the az functionapp connection list-support-types command to get a list of supported target services for Azure Functions.
```
az functionapp connection list-support-types --output table
```

Create a service connection

Use Service Connector to create a service connection between your Azure Functions app and Azure Blob Storage. This example demonstrates connecting to Blob Storage, but you can use the same process for other supported Azure services.

In the Azure portal, select the Search resources, services and docs (G +/) search bar at the top, type Function App, and select Function App.
Select the function app resource you want to connect to a target resource.
In the left navigation, select Service Connector, and then select Create.

On the Basics tab, select or enter the following settings:

Setting	Example	Description
Service type	Storage - Blob	The target service type. If you don't have a Blob Storage account, you can create one or use another service type.
Subscription	My subscription	The subscription for your target service (the service you want to connect to). The default value is the subscription for this function app resource.
Connection name	my_connection	The connection name that identifies the connection between your function app and target service. Use the connection name provided by Service Connector or choose your own connection name.
Storage account	my_storage_account	The target storage account you want to connect to. Target service instances to choose from vary according to the selected service type.
Client type	The same app stack on this function app	The default value comes from the function app runtime stack. Select the app stack that's on this function app instance.

Select Next: Authentication to choose an authentication method.
Select System-assigned managed identity to connect through an identity that's automatically generated in Microsoft Entra ID and tied to the lifecycle of the service instance. This is the recommended authentication option.

Select User-assigned managed identity to authenticate through a standalone identity assigned to one or more instances of an Azure service. Select a subscription that contains a user-assigned managed identity, and then select the identity.

If you don't have a user-assigned managed identity yet, select Create new to create one.
1. Select Service principal to use a service principal that defines the access policy and permissions for the user/application in Microsoft Entra ID.
2. Select a service principal from the list and enter a secret.
Warning

Microsoft recommends that you use the most secure authentication flow available. The authentication flow described in this procedure requires a very high degree of trust in the application, and carries risks that are not present in other flows. You should only use this flow when other more secure flows, such as managed identities, aren't viable.

Select Connection string to generate or configure one or multiple key-value pairs with pure secrets or tokens.
Select Next: Networking to configure network settings. Select Configure firewall rules to enable access to target service so that your function app can access the target service.
Select Next: Review + Create to review the provided information. Running the final validation takes a few seconds. Then select Create to create the service connection. This operation might take a minute to complete.

Managed identity (recommended)
Connection string

Run the az functionapp connection create command to create a service connection to Blob Storage with a system-assigned managed identity. You can run this command in two ways:

Generate the new connection step by step:

az functionapp connection create storage-blob --system-identity

Generate the new connection at once. Replace the placeholders with your own information: <source-subscription>, <source_resource_group>, <function-app>, <target-subscription>, <target_resource_group>, and <account>.

az functionapp connection create storage-blob \
   --source-id /subscriptions/<source-subscription>/resourceGroups/<source_resource_group>/providers/Microsoft.Web/sites/<function-app> \
   --target-id /subscriptions/<target-subscription>/resourceGroups/<target_resource_group>/providers/Microsoft.Storage/storageAccounts/<account>/blobServices/default \
   --system-identity

Tip

If you don't have a Blob Storage account, run az functionapp connection create storage-blob --new --system-identity to create one and connect it to your function app using a managed identity.

Warning

Microsoft recommends that you use the most secure authentication flow available. The authentication flow described in this procedure requires a very high degree of trust in the application, and carries risks that are not present in other flows. You should only use this flow when other more secure flows, such as managed identities, aren't viable.

Run the az functionapp connection create command to create a service connection to Blob Storage with a connection string. You can run this command in two ways:

Generate the new connection step by step:

az functionapp connection create storage-blob --secret

az functionapp connection create storage-blob \
   --source-id /subscriptions/<source-subscription>/resourceGroups/<source_resource_group>/providers/Microsoft.Web/sites/<function-app> \
   --target-id /subscriptions/<target-subscription>/resourceGroups/<target_resource_group>/providers/Microsoft.Storage/storageAccounts/<account>/blobServices/default \
   --secret name=<secret-name> secret=<secret>

Tip

If you don't have a Blob Storage account, run az functionapp connection create storage-blob --new --secret to create one and connect it to your function app using a connection string.

View and validate your service connections

After creating your service connection, you can view, validate, and manage all connections from your Azure Functions app.

Function app connections are displayed in the Service Connector service menu. Select > to expand the list and see the properties required by your application.
Select Validate to check your connection. You can see the connection validation details in the panel on the right.

Run the az functionapp connection list command to list all your function app's provisioned connections. Replace the placeholders <function-app-resource-group> and <function-app-name> with your own information. You can also remove the --output table option to view more information about your connections.

az functionapp connection list --resource-group "<function-app-resource-group>" --name "<function-app-name>" --output table

The output also displays the provisioning state of your connections.

Now that you've successfully connected your Azure Functions app to Azure Storage, explore these tutorials to build more advanced function applications with Service Connector:

Feedback

Was this page helpful?

Share via

Set up your environment

Select Connection string to generate or configure one or multiple key-value pairs with pure secrets or tokens.

Share via

Quickstart: Connect Azure Functions to databases and services with Service Connector

Prerequisites

Set up your environment

Create a service connection

View and validate your service connections

Related content

Feedback

Additional resources