title: ARM Templates for Azure Functions with many appSettings for different environments and slots
body: <p>I've got two Azure Function apps that use deployment slots, stage and production. These two Azure Function apps have about 50~ key:value pairs in Application Settings to define various API keys, application behavior, connection strings, etc. </p>
  
  <p>I want to deploy these two Azure Function apps to five different environments (CI, DEV, QA, STG, PROD). I believe that deploying these resources to Azure using ARM templates is the better choice over Azure CLI. I will create tasks in my Azure DevOps release pipeline to achieve this. </p>
  
  <p>In order to break down the ARM template into something easily maintainable, I wanted to create an ARM template parameter file for each environment. When defining the deployment file for the Azure Function, one of the properties to define is the <a href="https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites#SiteConfig" rel="noreferrer">siteConfig object</a>, where you define the appSettings object with a NameValuePair object. For each environment, the stage and production slot will have different API keys, connection strings, and application behavior. My deployment file creates the Azure Function app with both the production slot and stage slot. In the deployment file, I have to provide the appSettings NameValuePair object twice. Then, I have to create 5 different parameter files for each environment. Multiply that by 2 because I have two slots. </p>
  
  <p>Is it also true that all parameters defined in the parameter file have to be defined in the deployment template file in the parameters object? </p>
  
  <p>Can I just pass in an array of objects with NameValuePairs from the parameter file so I don't have to have the entire list of parameters defined in the deployment file at the top and also under siteConfig.appSettings for the function app? </p>
  
  <p><a href="https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-parameter-files#parameter-type-formats" rel="noreferrer">The documentation here</a> shows that you can only provide an array of strings or a single object with many key:values. But appSettings is an array of objects where each object has 3 key:value pairs.</p>
  
  <p>This is what the resource looks like in the deployment file. I would like to simply reference an entire array of objects from the parameter file, but it looks like the documentation states that I define all 50~ parameters at the top of the deployment file, which then the parameter file overrides when executed by Azure CLI or Azure DevOps task.</p>
  
  <pre><code>        {
              "type": "Microsoft.Web/sites",
              "apiVersion": "2018-11-01",
              "name": "[parameters('function-app-name')]",
              "location": "[parameters('location')]",
              "tags": {
                  "project": "[variables('projectName')]",
                  "env": "[parameters('deploymentEnvironment')]"
              },
              "kind": "functionapp",
              "properties": {
                  "enabled": true,
                  "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]",
                  "siteConfig": {
                      "appSettings": [] # I need to provide an array of objects here
                   }
              }
         }
  
  </code></pre>
  
  <p>In addition to my complaint...I can't believe I'm going to have to create 20 parameter files for all five environments and their two Azure Functions that have two slots. Is there a better way to deploy to all my environments and their deployment slots using ARM templates and parameter files with their unique application settings?</p>
  
  <p><strong>UPDATE:</strong> </p>
  
  <p>I was able to piece together various methods for creating environment-specific ARM templates and came up with the following result, with some inconvenient problems. First, I'll explain where I am now and then bring up the problems associated with the design. </p>
  
  <p>In my deployment template, I've defined two parameters. Here they are:</p>
  
  <pre><code>        "deploymentEnvironment": {
              "type": "string",
              "allowedValues": [
                  "CI",
                  "DEV",
                  "QA",
                  "TRN",
                  "STG",
                  "PROD"
              ],
              "metadata": {
                  "description": "Type of environment being deployed to. AKA \"Stage\" in release definition."
              }
          },
          "applicationSettings": {
              "type": "object",
              "metadata": {
                  "description": "Application settings from function.parameters.json"
              }
          }
  </code></pre>
  
  <p>My function.parameters.json has a structure like this:</p>
  
  <pre><code>{
      "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
          "applicationSettings": {
              "value": {
                  "CI": {
                      "appsetting1": "",
                      "appsetting2": ""
                  },
                  "DEV": {
                      "appsetting1": "",
                      "appsetting2": ""            },
                  "QA": {
                      "appsetting1": "",
                      "appsetting2": ""
                  }
              }
          }
      }
  }
  </code></pre>
  
  <p>For each environment, I had placed all of my connection strings, apikeys, and application settings. </p>
  
  <p>For the production slot for the function app, you can add a "resources" property which applies configuration to it. Here is the entire function app deployment:</p>
  
  <pre><code>        {
              "name": "[parameters('function-app-name')]",
              "type": "Microsoft.Web/sites",
              "apiVersion": "2018-11-01",
              "kind": "functionapp",
              "location": "[parameters('location')]",
              "tags": {
                  "project": "[variables('projectName')]",
                  "env": "[parameters('deploymentEnvironment')]"
              },
              "properties": {
                  "enabled": true,
                  "serverFarmId": "[resourceId('Microsoft.Web/serverfarms/', variables('appServicePlanName'))]"
              },
              "dependsOn": [
                  "[resourceId('Microsoft.Insights/components/', variables('applicationInsightsName'))]",
                  "[resourceId('Microsoft.Web/serverfarms/', variables('appServicePlanName'))]",
                  "[resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]"
              ],
              "resources": [
                  {
                      "name": "appsettings",
                      "type": "config",
                      "apiVersion": "2018-11-01",
                      "properties": "[parameters('applicationSettings')[parameters('deploymentEnvironment')]]",
                      "dependsOn": [
                          "[resourceId('Microsoft.Web/sites/', parameters('function-app-name'))]"
                      ]
                  }
              ]
          }
  </code></pre>
  
  <p>Next up was defining the stage slot deployment resource. Here it is:</p>
  
  <pre><code>        {
              "type": "Microsoft.Web/sites/slots",
              "apiVersion": "2018-11-01",
              "name": "[concat(parameters('function-app-name'), '/stage')]",
              "location": "[parameters('location')]",
              "dependsOn": [
                  "[resourceId('Microsoft.Web/sites/', parameters('function-app-name'))]"
              ],
              "tags": {
                  "project": "[variables('projectName')]",
                  "env": "[parameters('deploymentEnvironment')]"
              },
              "kind": "functionapp",
              "properties": {
                  "enabled": true,
                  "serverFarmId": "[resourceId('Microsoft.Web/serverfarms/', variables('appServicePlanName'))]"
              },
              "resources": [
                  {
                      "name": "appsettings",
                      "type": "config",
                      "apiVersion": "2018-11-01",
                      "properties": "[parameters('applicationSettings')[parameters('deploymentEnvironment')]]",
                      "dependsOn": [
                          "[resourceId('Microsoft.Web/sites/', parameters('function-app-name'))]",
                          "[resourceId('Microsoft.Web/sites/slots/', parameters('function-app-name'), 'stage')]"
                      ]
                  }
              ]
          }
  </code></pre>
  
  <p>With this solution, I don't have to have a bunch of parameters.json files for each environment. </p>
  
  <p><em>The problems...</em></p>
  
  <p>Defining all of the application settings in parameters.json means I can't use template functions to get connection strings or Azure Key Vault values. </p>
  
  <p>This is when I started to move some of the application settings to the deployment template to use template functions. So instead of having the APPINSIGHTS_INSTRUMENTATIONKEY and other AzureWebJobs* application settings in the parameters.json file, I provided the <a href="https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites#SiteConfig" rel="noreferrer">siteConfig object</a> in the "properties" object for the <a href="https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites" rel="noreferrer">Microsoft.Web/Sites resource</a> and the <a href="https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites/slots" rel="noreferrer">Microsoft.Web/Sites/Slots resource</a>.</p>
  
  <p>This is the real bummer - When the deployment ran, it applied the siteConfig.appsettings values with the function app, then when it applied the parameters.json file, it <em>deleted the application settings and applied only the ones from the json, instead of merging them together</em>. That was a HUGE disappointment. In my initial testing with the AzureCLI, I used this command <code>az functionapp config appsettings set --name $functionAppName --resource-group $resourceGroupName --settings $settingsFile  --slot $slot</code> to test what would happen with application settings that were not in a json file and was happy that it never deleted application settings. The powershell command gets and sets the values, merging it nicely and never deleting. But the ARM API deletes all those name value pairs and applies only what is defined. <strong>This means I cannot use template functions to create dynamic application settings and a json file to apply static application settings.</strong></p>
  
  <p>As of now, I feel like the only way to do a decent ARM template deployment is just deploy the resources without the siteConfig object or the config resource to apply application settings and then follow up with the Azure CLI to deploy the application settings. I suppose I could learn how to retrieve Key Vault secrets using Azure CLI or Azure DevOps pipeline tasks, but it would be even better to just have it all in a single ARM template. </p>
  
  <p>For reference, here is my entire deployment template when I attempted to use dynamically generated appSettings and the config resource to define more appsettings.</p>
  
  <pre><code>{
      "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
          "function-app-name": {
              "defaultValue": "functionappname",
              "type": "String",
              "metadata": {
                  "description": "The name of the function app that you wish to create."
              }
          },
          "sku": {
              "type": "string",
              "allowedValues": [
                  "S1",
                  "S2",
                  "S3"
              ],
              "defaultValue": "S3",
              "metadata": {
                  "description": "The pricing tier for the hosting plan."
              }
          },
          "storageAccountType": {
              "type": "string",
              "defaultValue": "Standard_LRS",
              "metadata": {
                  "description": "Storage Account type"
              }
          },
          "location": {
              "type": "string",
              "defaultValue": "southcentralus",
              "metadata": {
                  "description": "Location for all resources."
              }
          },
          "deploymentEnvironment": {
              "type": "string",
              "allowedValues": [
                  "CI",
                  "DEV",
                  "QA",
                  "TRN",
                  "STG",
                  "PROD"
              ],
              "metadata": {
                  "description": "Type of environment being deployed to."
              }
          },
          "applicationSettings": {
              "type": "object",
              "metadata": {
                  "description": "Application settings from function.parameters.json"
              }
          }
      },
      "variables": {
          "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]",
          "appServicePlanName": "[concat('ASP-', uniquestring(resourceGroup().id))]",
          "applicationInsightsName": "[concat('appInsights-', uniquestring(resourceGroup().id))]",
          "projectName": "DV"
      },
      "resources": [
          {
              "type": "Microsoft.Storage/storageAccounts",
              "apiVersion": "2019-04-01",
              "name": "[variables('storageAccountName')]",
              "kind": "Storage",
              "location": "[parameters('location')]",
              "sku": {
                  "name": "[parameters('storageAccountType')]"
              },
              "tags": {
                  "project": "[variables('projectName')]",
                  "env": "[parameters('deploymentEnvironment')]"
              }
          },
          {
              "name": "[variables('appServicePlanName')]",
              "type": "Microsoft.Web/serverfarms",
              "apiVersion": "2019-08-01",
              "location": "[parameters('location')]",
              "properties": {
              },
              "tags": {
                  "project": "[variables('projectName')]",
                  "env": "[parameters('deploymentEnvironment')]"
              },
              "sku": {
                  "Name": "[parameters('sku')]",
                  "capacity": 2
              },
              "dependsOn": [
                  "[resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]"
              ]
          },
          {
              "name": "[variables('applicationInsightsName')]",
              "apiVersion": "2015-05-01",
              "type": "Microsoft.Insights/components",
              "kind": "web",
              "location": "[parameters('location')]",
              "tags": {
                  "project": "[variables('projectName')]",
                  "env": "[parameters('deploymentEnvironment')]"
              },
              "properties": {
                  "Application_Type": "web"
              }
          },
          {
              "name": "[parameters('function-app-name')]",
              "type": "Microsoft.Web/sites",
              "apiVersion": "2018-11-01",
              "kind": "functionapp",
              "location": "[parameters('location')]",
              "tags": {
                  "project": "[variables('projectName')]",
                  "env": "[parameters('deploymentEnvironment')]"
              },
              "properties": {
                  "enabled": true,
                  "serverFarmId": "[resourceId('Microsoft.Web/serverfarms/', variables('appServicePlanName'))]",
                  "siteConfig": {
                      "appSettings": [
                          {
                              "name": "APPINSIGHTS_INSTRUMENTATIONKEY",
                              "value": "[reference(concat('microsoft.insights/components/', variables('applicationInsightsName'))).InstrumentationKey]"
                          },
                          {
                              "name": "AzureWebJobsDashboard",
                              "value": "[concat('DefaultEndpointsProtocol=https;AccountName=',variables('storageAccountName'),';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2019-06-01').keys[0].value)]"
                          },
                          {
                              "name": "AzureWebJobsStorage",
                              "value": "[concat('DefaultEndpointsProtocol=https;AccountName=',variables('storageAccountName'),';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2019-06-01').keys[0].value)]"
                          },
                          {
                              "name": "FUNCTIONS_EXTENSION_VERSION",
                              "value": "~1"
                          }
                      ]
                  }
              },
              "dependsOn": [
                  "[resourceId('Microsoft.Insights/components/', variables('applicationInsightsName'))]",
                  "[resourceId('Microsoft.Web/serverfarms/', variables('appServicePlanName'))]",
                  "[resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]"
              ],
              "resources": [
                  {
                      "name": "appsettings",
                      "type": "config",
                      "apiVersion": "2018-11-01",
                      "properties": "[parameters('applicationSettings')[parameters('deploymentEnvironment')]]",
                      "dependsOn": [
                          "[resourceId('Microsoft.Web/sites/', parameters('function-app-name'))]"
                      ]
                  }
              ]
          },
          {
              "type": "Microsoft.Web/sites/slots",
              "apiVersion": "2018-11-01",
              "name": "[concat(parameters('function-app-name'), '/stage')]",
              "location": "[parameters('location')]",
              "dependsOn": [
                  "[resourceId('Microsoft.Web/sites/', parameters('function-app-name'))]"
              ],
              "tags": {
                  "project": "[variables('projectName')]",
                  "env": "[parameters('deploymentEnvironment')]"
              },
              "kind": "functionapp",
              "properties": {
                  "enabled": true,
                  "serverFarmId": "[resourceId('Microsoft.Web/serverfarms/', variables('appServicePlanName'))]",
                  "siteConfig": {
                      "appSettings": [
                          {
                              "name": "APPINSIGHTS_INSTRUMENTATIONKEY",
                              "value": "[reference(concat('microsoft.insights/components/', variables('applicationInsightsName'))).InstrumentationKey]"
                          },
                          {
                              "name": "AzureWebJobsDashboard",
                              "value": "[concat('DefaultEndpointsProtocol=https;AccountName=',variables('storageAccountName'),';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2019-06-01').keys[0].value)]"
                          },
                          {
                              "name": "AzureWebJobsStorage",
                              "value": "[concat('DefaultEndpointsProtocol=https;AccountName=',variables('storageAccountName'),';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2019-06-01').keys[0].value)]"
                          },
                          {
                              "name": "FUNCTIONS_EXTENSION_VERSION",
                              "value": "~1"
                          }
                      ]
                  },
                  "resources": [
                      {
                          "name": "appsettings",
                          "type": "config",
                          "apiVersion": "2018-11-01",
                          "properties": "[parameters('applicationSettings')[parameters('deploymentEnvironment')]]",
                          "dependsOn": [
                              "[resourceId('Microsoft.Web/sites/', parameters('function-app-name'))]"
                          ]
                      }
                  ]
              }
          }
      ]
  }
  </code></pre>
  
  <p><strong>Update 2:</strong> </p>
  
  <p><a href="https://github.com/Azure/azure-cli/issues/11718" rel="noreferrer">I raised a github issue to have them fix the problem with ARM templates replacing all of the application settings on each deployment.</a>
  FWIW - <a href="https://feedback.azure.com/forums/281804-azure-resource-manager/suggestions/31985941-no-parity-between-function-app-and-web-app-app-set" rel="noreferrer">I also voted on some Azure feedback post</a>. </p>