Not able to DISABLE the function in Azure function app with custom role

Urmila Purohit hi & thanks for posting this on q&a, ))

first off, u need to add 'microsoft.web/sites/functions/properties/write' permission to ur custom role. thats the magic sauce here )) the error message literally tells us this its missing that specific action. https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference#permissions.

even if u have 'microsoft.web/sites/functions/write', it doesnt cover the properties/state change for disabling. azure permissions can be annoyingly specific like that )

quick test u can do right now assign the built-in 'website contributor' role temporarily to see if it works. if yes, then u know its just about tweaking ur custom role permissions.

always look at the exact error message when rbac fails. azure usually tells u which permission is missing, just gotta read it like a treasure map :))

check the scope where u assigned the custom role. sometimes people assign it at subscription level when it should be at resource group or function app level.

when creating custom roles in azure, its often easier to clone an existing built-in role and modify it rather than building from scratch. saves u from missing those sneaky permissions ))

even if u have full access at resource group level, individual resource permissions can override that. azure rbac is like an onion, lots of layers %)

here's another doc u might find useful about function app operations https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftweb.

let me know if adding that properties/write permission does the trick

Best regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer

https://ctrlaltdel.blog/

Hii, Alex Burlachenko,
I tried to create custom role with "microsoft.web/sites/functions/properties/write" but this kind of permission do not exist in custom role. it show below error:
Validation error: Invalid action is present in "actions" : microsoft.web/sites/functions/properties/write.

Hi @Urmila Purohit ,

I was able to fix it by adding the permission "Microsoft.Web/sites/functions/*". Sadly you can't only add the microsoft.web/sites/functions/properties/write, because then you get the error you mentioned. I also tried "Microsoft.Web/sites/functions/properties/*", but that didn't work either.