03 - Configuration (Dedicated)¶

This tutorial configures runtime settings for a Dedicated Function App using classic App Service configuration patterns. On Dedicated, use siteConfig.appSettings style settings and remember the plan is always running and billed 24/7.

Prerequisites¶

Completed 02 - First Deploy
Environment variables set:

export RG="rg-func-dedicated-dev"
export APP_NAME="func-dedi-<unique-suffix>"
export PLAN_NAME="asp-dedi-b1-dev"
export STORAGE_NAME="stdedidev<unique>"
export LOCATION="koreacentral"

What You'll Build¶

You will configure required app settings, apply runtime options such as Always On, and validate Dedicated-specific scaling and timeout behavior.

Infrastructure Context

Plan: Dedicated (B1) | Network: Public internet in this tutorial | VNet: Supported by platform, not configured here

The app runs on a fixed App Service Plan (always on, no scale-to-zero). Basic B1 supports App Service VNet integration and private endpoints, but this guide uses Standard (S1+) for private networking scenarios to provide scale headroom, deployment slots, and a production-oriented validation path.

flowchart TD
    INET[Internet] -->|HTTPS| FA[Function App\nDedicated B1-P3v3\nLinux Python 3.11]

    subgraph VNET["VNet 10.0.0.0/16"]
        subgraph INT_SUB["Integration Subnet 10.0.1.0/24\nDelegation: Microsoft.Web/serverFarms"]
            FA
        end
        subgraph PE_SUB["Private Endpoint Subnet 10.0.2.0/24"]
            PE_BLOB[PE: blob]
            PE_QUEUE[PE: queue]
            PE_TABLE[PE: table]
            PE_FILE[PE: file]
        end
    end

    PE_BLOB --> ST["Storage Account"]
    PE_QUEUE --> ST
    PE_TABLE --> ST
    PE_FILE --> ST

    subgraph DNS[Private DNS Zones]
        DNS_BLOB[privatelink.blob.core.windows.net]
        DNS_QUEUE[privatelink.queue.core.windows.net]
        DNS_TABLE[privatelink.table.core.windows.net]
        DNS_FILE[privatelink.file.core.windows.net]
    end

    PE_BLOB -.-> DNS_BLOB
    PE_QUEUE -.-> DNS_QUEUE
    PE_TABLE -.-> DNS_TABLE
    PE_FILE -.-> DNS_FILE

    FA -.->|System-Assigned MI| ENTRA[Microsoft Entra ID]
    FA --> AI[Application Insights]

    RFP["📦 WEBSITE_RUN_FROM_PACKAGE=1\nNo content share required"] -.- FA
    ALWAYS_ON["⚙️ Always On: true\nFixed capacity"] -.- FA

    style FA fill:#5c2d91,color:#fff
    style VNET fill:#E8F5E9,stroke:#4CAF50
    style ST fill:#FFF3E0
    style DNS fill:#E3F2FD

flowchart TD
    A[Function App settings] --> B[Runtime config on Dedicated plan]
    B --> C[Validated effective configuration]

Steps¶

Step 1 - Review current app settings¶

az functionapp config appsettings list \
  --name $APP_NAME \
  --resource-group $RG \
  --output table

CLI element	Explanation
Command(s)	`az functionapp config appsettings list`
Key flags	`--name`, `--resource-group`, `--output`
Variables	`$APP_NAME`, `$RG`
Expected result	Azure CLI applies the configuration change; confirm the returned JSON or follow-up query shows the expected value.

Step 2 - Set required and custom app settings¶

Dedicated supports both connection-string and identity-based host storage configuration.

Connection-string option:

STORAGE_CONNECTION_STRING=$(az storage account show-connection-string \
  --name $STORAGE_NAME \
  --resource-group $RG \
  --query connectionString \
  --output tsv)

az functionapp config appsettings set \
  --name $APP_NAME \
  --resource-group $RG \
  --settings \
    FUNCTIONS_WORKER_RUNTIME=python \
    AzureWebJobsStorage="$STORAGE_CONNECTION_STRING" \
    APP_ENV=dedicated-dev

CLI element	Explanation
Command(s)	`az storage account show-connection-string`, `az functionapp config appsettings set`
Key flags	`--name`, `--resource-group`, `--query`, `--output`, `--settings`
Variables	`$STORAGE_NAME`, `$RG`, `$APP_NAME`, `$STORAGE_CONNECTION_STRING`
Expected result	Azure CLI applies the configuration change; confirm the returned JSON or follow-up query shows the expected value.

Identity-based option (alternative):

az functionapp identity assign \
  --name $APP_NAME \
  --resource-group $RG

az functionapp config appsettings set \
  --name $APP_NAME \
  --resource-group $RG \
  --settings \
    AzureWebJobsStorage__accountName=$STORAGE_NAME \
    AzureWebJobsStorage__credential=managedidentity

CLI element	Explanation
Command(s)	`az functionapp identity assign`, `az functionapp config appsettings set`
Key flags	`--name`, `--resource-group`, `--settings`
Variables	`$APP_NAME`, `$RG`, `$STORAGE_NAME`
Expected result	Azure CLI applies the configuration change; confirm the returned JSON or follow-up query shows the expected value.

Identity-based storage requires Managed Identity and RBAC

Before using identity-based host storage, you must:

Enable system-assigned managed identity on the Function App (as shown above).
Grant host storage data-plane roles on the storage account scope. At minimum include Storage Blob Data Owner, Storage Queue Data Contributor, and Storage Table Data Contributor (the host uses blobs, queues, and tables): az role assignment create --assignee-object-id "<principal-id>" --role "Storage Blob Data Owner" --scope "/subscriptions/<subscription-id>/resourceGroups/$RG/providers/Microsoft.Storage/storageAccounts/$STORAGE_NAME"
Set both AzureWebJobsStorage__accountName and AzureWebJobsStorage__credential=managedidentity app settings.

Step 3 - Configure runtime behavior¶

az functionapp config set \
  --name $APP_NAME \
  --resource-group $RG \
  --always-on true \
  --number-of-workers 1

CLI element	Explanation
Command(s)	`az functionapp config set`
Key flags	`--name`, `--resource-group`, `--always-on`, `--number-of-workers`
Variables	`$APP_NAME`, `$RG`
Expected result	Azure CLI applies the configuration change; confirm the returned JSON or follow-up query shows the expected value.

Step 4 - Set function timeout in host.json¶

Update apps/python/host.json with a Dedicated-friendly timeout value:

{
  "version": "2.0",
  "functionTimeout": "00:30:00"
}

On Dedicated, default timeout is 30 minutes and maximum timeout is unlimited.

Step 5 - Understand plan behavior and scaling¶

Dedicated does not scale to zero.
Scaling on Basic (B1) is manual only. Autoscale rules are available on Standard and higher tiers.
Typical maximum instance limits by Dedicated tier are Basic: 3, Standard: 10, Premium: 30.
Memory and CPU are determined by plan SKU (B1, S1, P1v2, and others).
Windows and Linux are both supported.

Step 6 - Confirm effective configuration¶

az functionapp config show \
  --name $APP_NAME \
  --resource-group $RG \
  --query "{alwaysOn:alwaysOn,linuxFxVersion:linuxFxVersion,numberOfWorkers:numberOfWorkers}" \
  --output json

CLI element	Explanation
Command(s)	`az functionapp config show`
Key flags	`--name`, `--resource-group`, `--query`, `--output`
Variables	`$APP_NAME`, `$RG`
Expected result	Azure CLI applies the configuration change; confirm the returned JSON or follow-up query shows the expected value.

Dedicated uses classic configuration model

For Dedicated (App Service Plan), configure settings through classic App Service app settings (siteConfig.appSettings). Do not use functionAppConfig in this plan.

Verification¶

az functionapp config appsettings set ...:

{
  "id": "/subscriptions/<subscription-id>/resourceGroups/rg-func-dedicated-dev/providers/Microsoft.Web/sites/func-dedi-<unique-suffix>/config/appsettings",
  "location": "Korea Central",
  "name": "appsettings",
  "properties": {
    "APP_ENV": "dedicated-dev",
    "AzureWebJobsStorage": "DefaultEndpointsProtocol=https;AccountName=<masked>;AccountKey=<masked>;EndpointSuffix=core.windows.net",
    "FUNCTIONS_WORKER_RUNTIME": "python"
  }
}

az functionapp config show ... --query ...:

{
  "alwaysOn": true,
  "linuxFxVersion": "Python|3.11",
  "numberOfWorkers": 1
}

Next Steps¶

You now have a correctly configured Dedicated app with explicit runtime settings and Always On enabled. Next you will add observability with logs, metrics, and alerts.

Next: 04 - Logging & Monitoring