Getting error “Failed to decrypt settings…” when trying to start Azure bot function

Question

We have a bot endpoint implemented as an Azure function and it's running fine within Azure.

We've followed this process to enable us to run/debug the Azure Function locally: https://docs.microsoft.com/en-us/azure/azure-functions/functions-run-local

In particular, the following PowerShell command:

func azure functionapp fetch-app-settings <FunctionAppName>

It appears to run fine and put the necessary settings into local.settings.json, which is output to bin when the project is built. However, when we start the function (Right click project - Debug - Start new instance) it gives this error:

Failed to decrypt settings. Encrypted settings only be edited through 'func settings add'.

On two machines we are getting the above decryption error, on two machines it is running fine.

Any suggestions?

P.S. We are not trying to share the same local.settings.json file between machines, which I understand would also yield this sort of error.

UPDATE

Here is the content of the local.settings.json file from a problem machine, with encrypted values removed:

{
  "IsEncrypted": true,
  "Values": {
    "AzureWebJobsStorage": "[encrypted content]",
    "AzureWebJobsDashboard": "[encrypted content]",
    "FUNCTIONS_EXTENSION_VERSION": "[encrypted content]",
    "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING": "[encrypted content]",
    "WEBSITE_CONTENTSHARE": "[encrypted content]",
    "WEBSITE_NODE_DEFAULT_VERSION": "[encrypted content]",
    "BotEnv": "[encrypted content]",
    "BotId": "[encrypted content]",
    "MicrosoftAppId": "[encrypted content]",
    "MicrosoftAppPassword": "[encrypted content]",
    "BotStateEndpoint": "[encrypted content]",
    "BotOpenIdMetadata": "[encrypted content]",
    "UseTableStorageForConversationState": "[encrypted content]",
    "BotDevAppInsightsKey": "[encrypted content]",
    "BotDevAppInsightsName": "[encrypted content]",
    "BotDevAppInsightsAppId": "[encrypted content]",
    "AzureWebJobsBotFrameworkDirectLineSecret": "[encrypted content]",
    "AzureWebJobsBotFrameworkDirectLineEndpoint": "[encrypted content]",
    "WEBSITE_USE_PLACEHOLDER": "[encrypted content]",
    "APPINSIGHTS_INSTRUMENTATIONKEY": "[encrypted content]",
    "MSDEPLOY_RENAME_LOCKED_FILES": "[encrypted content]"
  },
  "ConnectionStrings": {}
}

Could you show this local.settings.json file (secrets obfuscated)? — Mikhail Shilkov
I have added the local.settings.json file content to the question but omitted the encrypted values, is that what you meant? — Michael12345
What type of authentication the function app is using.. like anonymous or function key etc? — Baskar Rao
We are using an AppId and Password stored in the MicrosoftAppId and MicrosoftAppPassword settings. I understand that these are only required when we try to connect to Azure Storage. We've tested the AppId and password are correct, and these settings work when hosted in Azure. There seems to be some sort of local issue where the func azure functionapp fetch-app-settings PowerShell script creates encrypted settings that the local func.exe cannot decrypt. — Michael12345
I'm not sure what the issue is as everything you're doing seems fine. Is the user who ran fetch, the same as the one who is trying to read the secrets? can you try setting CLI_DEBUG = 1 environment variable and run func settings list from that window? That exception is only used if decrypt function throws, so I'm a bit baffled how it can write a file it can't read again. — ahmelsayed

Richard Barat Richard Barat · Accepted Answer · 2019-06-06T13:54:52

Change the falue of IsEncrypted as follows :

"IsEncrypted": false,

in local.settings.json

Getting error “Failed to decrypt settings…” when trying to start Azure bot function

3 Answers