Hosting Plan Security Comparison Matrix¶

Quick-reference comparison of Azure Functions hosting plan behavior under identity and networking fault conditions. Data collected from real Azure deployments across all four hosting plans.

Prerequisites¶

• Access to the full companion lab guide: hosting-plan-security-matrix.md
• Access to Azure Monitor logs and Activity Log for affected Function Apps
• Familiarity with hosting plan names used in this matrix:
  • FC1 = Flex Consumption
  • EP1 = Premium
  • Y1 = Consumption
  • S1 = Dedicated

Topic/Command Groups¶

1) Feature Support Matrix¶

2) Error Signature Matrix¶

Use this as the first triage table when an operator only has a front-door symptom.

3) Failure Detection Time Matrix¶

4) Detection Difficulty Ranking¶

Ranked from hardest to easiest:

1. Identity removal on EP1/Dedicated (invisible until restart/token expiry)
2. DNS break on FC1 (health stays green)
3. PE deletion with stale DNS (misleading DNS resolution)
4. RBAC removal on any plan (relatively fast, clear errors)

5) Diagnostic Decision Tree¶

flowchart TD
    A[Start: Function endpoint failing] --> B{HTTP pattern?}
    B -->|HTTP 000 timeout| C{Plan family?}
    B -->|502 Server Error| D[Y1 likely; check RBAC or identity]
    B -->|503 Function host is not running| E[EP1 or S1 likely; inspect host startup and storage auth]
    B -->|"503 :( Application Error"| F[EP1 likely DNS or network private path issue]

    C -->|FC1| G{Health endpoint green?}
    C -->|EP1 or S1| H{Recent restart?}

    G -->|Yes| I[Prioritize DNS break on storage path]
    G -->|No| J[Check FC1 network break or RBAC break]

    H -->|No| K["Restart app then re-evaluate identity/DNS fault visibility"]
    H -->|Yes| L[Validate identity assignment and role scope immediately]

    D --> M[Check role assignments and identity enablement]
    E --> N[Check startup logs for storage auth and host runtime signals]
    F --> O[Check private endpoint existence and DNS records]

    I --> P[Verify DNS zone links and private A records]
    J --> Q[Verify PE existence plus effective routes]
    L --> R[Correlate restart timestamp with first error]

    M --> S[Likely fault: RBAC removal or identity removal]
    N --> S
    O --> T[Likely fault: DNS break or network break]
    P --> T
    Q --> T
    R --> S

6) DNS Resolution Comparison¶

7) Recovery Procedure Quick Reference¶

8) Error Text Classifier (EP1 Focus)¶

9) Restart Sensitivity Matrix¶

Use this to avoid false negatives when a fault can remain hidden until recycle.

10) First Evidence to Pull¶

11) Recovery Decision Tree¶

flowchart TD
    A[Start recovery] --> B{Fault family confirmed?}
    B -->|Auth| C[Restore identity or RBAC]
    B -->|Network| D["Restore DNS link and/or private endpoint"]

    C --> E{Plan is EP1 or S1?}
    E -->|Yes| F[Restart app to flush cached state]
    E -->|No| G[Re-test after propagation window]

    D --> H{Private DNS answers expected private IP?}
    H -->|No| I[Fix zone links and A records]
    H -->|Yes| J[Validate private endpoint exists and is approved]

    F --> K[Re-run health plus function endpoint checks]
    G --> K
    I --> K
    J --> K

    K --> L{Error signature cleared?}
    L -->|Yes| M[Close incident]
    L -->|No| N[Escalate with logs, DNS capture, and Activity Log timeline]

Usage Notes¶

Fast triage sequence¶

1. Match observed error text to the Error Signature Matrix.
2. Confirm plan type (FC1, EP1, Y1, S1).
3. Use Detection Time Matrix to estimate whether fault is expected to be visible yet.
4. Validate identity and RBAC first for auth-like signatures.
5. Validate DNS plus private endpoint state together for network-like signatures.

Operator shorthand¶

See Also¶

• Hosting Plan Security Matrix Lab Guide — Full lab guide with evidence
• Managed Identity Authentication - Single-plan MI lab
• DNS VNet Resolution - DNS troubleshooting lab
• Storage Access Failure - Storage access lab

Sources¶

• Microsoft Learn: Azure Functions networking
• Microsoft Learn: Azure Functions managed identity
• Microsoft Learn: Private endpoints for Azure Storage
• Microsoft Learn: Azure Functions hosting plans