Azure-docs: Using AD Authentication is not possible on Linux Consumption plan for Azure Functions

[JarroVGIT]

It is not documented but it seems that you can't use this when you are trying to use this in an Function App that runs on a Consumption Plan for Linux. Could this be clarified and if this is on the roadmap? Using Python in Azure Functions forces you into a Linux plan but if you want to leverage AAD for authentication you are then forced to use a Premium Plan (adding unnecessary cost imo).

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 6f1c454d-73bc-5a73-5d3f-1b1ca7625044
• Version Independent ID: 552b3f09-6650-e7f7-01f2-a702005b83e9
• Content: Configure Azure AD authentication - Azure App Service
• Content Source: articles/app-service/configure-authentication-provider-aad.md
• Service: app-service
• GitHub Login: @cephalin
• Microsoft Alias: cephalin

[Grace-MacJones-MSFT]

Hi @djerro123, thank you for the detailed question. We are currently investigating and will update you when we have accurate information to provide.

[mike-urnun-msft]

@JarroVGIT Right, While EasyAuth isn't available with Linux Consumption tier, you should still be able to use AAD Auth by creating your AAD app separately.

[Grace-MacJones-MSFT]

Hi @JarroVGIT, along with Mike's answer I have submitted a PR to update the doc with a note, the change is merged internally and will go-live in the public docs shortly. Thanks!

We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

[yputter]

Hi @mike-urnun-msft, could you give me a little bit more detail (or a link) as to how to do it with "use AAD auth by creating your AAD app separately"? Also, any updates on when to expect EasyAuth for Azure Functions on Linux Consumption Plan?

[JarroVGIT]

I never figured that part out either. It seems to me that you would register an application in AAD, then allow a user/service principal access to said application (in case of SPN, this isn't trivial and can only be accomplished by using Powershell btw). Then the calling application would have to manually requests an access_token from AAD, post that with the Authorization header, and then your Python function would validate that token. However, I failed on the last step as there is no "middleware" (quotes because that is the term MSFT uses here in the docs) available for Python to manually validate that token, using the client credentials from step 1 (register the app).

Maybe I am not versed well enough in this topic, but that at least is where I stopped and moved to a (expensive) Premium Plan.

[munkii]

@mike-urnun-msft I too would like some detail on how to implement the suggested "use AAD auth by creating your AAD app separately". I feel that Azure Functions are aimed at developers who are looking for tools that hide as much of the plumbing as possible. Therefore I'd expect a lot of people using Linux as the OS for their Function could do with some assistance with this.