Setting Azure Function app settings with VSTS without exposing in the Azure Portal

Question

We're using VSTS for building various Azure Web Apps and deploying them to different environments. During the release process we are performing transformations on Web.config files, using variables stored in VSTS for things like connection strings per environment.

We want to do a similar thing with Azure Functions but we've had issues. We've found that performing transforms to the appsettings.json file doesn't work. New key/value pairs added aren't working in Azure and changes to existing ones aren't being loaded in Azure.

I've looked through countless documents and have only found documentation stating that app settings for Azure Functions must be stored using the Azure Portal, or set using a PowerShell script during the release process. However, these solutions then expose connection strings and other secrets to anyone who has access to the Azure Portal, which is not what we want.

How can I provide app settings to Azure Functions, such as the AzureWebJobsStorage and AzureWebJobsDashboard values, without exposing them on the Azure Portal?

Answer 1

However, these solutions then expose connection strings and other secrets to anyone who has access to the Azure Portal, which is not what we want.

That is not a correct assumption. Only users that are contributors or admins on that Function App can see the app settings. And those same users can see all the deployed files, so if you have secrets in deployed files, they are equally visible.

The benefit of using App Setting over having your secrets in files are:

• The App Settings secrets and encrypted at rest
• You're less likely to accidentally leak a secret by downloading deployed files without realizing they have secrets.