[BUG]: AzureFunctionApp task incorrectly replaces WEBSITE_RUN_FROM_PACKAGE when using Managed Identity

[andyfisher100]

New issue checklist

• I searched for existing GitHub issues
• I read pipeline troubleshooting guide
• I checked how to collect logs

Task name

AzureFunctionApp

Task version

2

Issue Description

By default when using the AzureFunctionApp task to deploy a linux consumption based function, the task creates an app setting WEBSITE_RUN_FROM_PACKAGE. The value is set to a newly generated SAS token to the function apps package location within the storage account

However, as per the Microsoft documentation here, a managed identity can be used instead of a SAS. This is preferred as there is no SAS token used that will eventually expire. In order to use a managed identity, WEBSITE_RUN_FROM_PACKAGE needs to be set to the URL of the function apps package within the storage account

However, after configuring the app to use a managed identity, the value of WEBSITE_RUN_FROM_PACKAGE is reset to a SAS once the pipeline is ran again

The expected outcome would be that the task identifies the use of a managed identity and just updates the url to the newly pushed package uploaded to the storage account

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

Windows Server 2022

Relevant log output

Updated App Service Application settings.
Updated WEBSITE_RUN_FROM_PACKAGE Application setting to https://REDACTED.blob.core.windows.net/azure-pipelines-deploy/package_1743180012542.zip?***

Full task logs with system.debug enabled

No response

Repro steps

1. Configure a linux based consumption plan function app
2. Deploy code to app using azure devops task in a pipeline
3. Note that WEBSITE_RUN_FROM_PACKAGE is a SAS
4. Update function app to use Managed identity to access the web job storage per the MS documentation
5. WEBSITE_RUN_FROM_PACKAGE is now configured as a url
6. Run the pipeline from step 2
7. WEBSITE_RUN_FROM_PACKAGE is reverted to SAS

[LarsCelie]

Same issue for us, our function app suddenly stopped working after a year of non-deployment because sas token expired. We have managed identity set up, so this would be a great fix