title: Is there a way to secure an Azure Function that will only be called from a specific Azure Logic App?
body: <p>I understand that Azure Functions are potentially open endpoints on the internet if I read Microsoft’s documentation correctly and per conversations with a friend who has some experience working with web development paradigms that Azure Functions leverages. A cursory reading of security forums and stack overflow questions on the topic leads me to understand at least a couple options of securing them namely </p>
  
  <ol>
  <li><a href="https://azure.microsoft.com/en-us/services/active-directory/" rel="nofollow noreferrer">Azure Active Directory</a>  </li>
  <li><a href="https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1" rel="nofollow noreferrer">Shared Access Signatures (SAS)</a> and </li>
  <li><a href="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview" rel="nofollow noreferrer">Azure Virtual Networks</a>.</li>
  </ol>
  
  <p>Context/ What does my Azure Function do? It manages a blob container related to an ETL of vendor data from a SFTP source to a SQL Endpoint which this ETL utilizes an intermediary blob container for file transfer and long term cold storage of source data. The Azure Function moves the blobs from one container to an archive container after they have been loaded to the SQL endpoint. Why Azure Function to manage the blob containers?</p>
  
  <ol>
  <li>SSIS lacks ability to perform blob manipulation (i.e copy and delete) </li>
  <li>Logic App lacks ability to perform a join (of files loaded to SQL endpoint and file names in blob container)</li>
  </ol>
  
  <p>An example of one of the functions is shown here below:</p>
  
  <pre class="lang-cs prettyprint-override"><code>using System.IO;
  using System.Threading.Tasks;
  using Microsoft.Azure.WebJobs;
  using Microsoft.Azure.WebJobs.Extensions.Http;
  using Microsoft.AspNetCore.Http;
  using Microsoft.Extensions.Logging;
  using Newtonsoft.Json;
  using System.Net.Http;
  using System.Net;
  using Microsoft.WindowsAzure.Storage.Blob;
  using System.Collections.Generic;
  using System.Text;
  
  namespace AFA_ArchiveBlob
  {
      public static class HttpTrigger_BlobInput
      {
          [FunctionName("HttpTrigger_BlobInput")]
          public static async Task&lt;HttpResponseMessage&gt; Run(
          //public static async Task&lt;IActionResult&gt; Run(
              [HttpTrigger(AuthorizationLevel.Function, "get",  Route = "{name}")] HttpRequest req,
              string name,
              ILogger log,
              [Blob("{name}/blobname",FileAccess.ReadWrite,Connection = "AzureWebJobsStorage")]  CloudBlobContainer myCloudBlobContainer
              )
          {
              //Execution Logged.
              log.LogInformation($"HttpTrigger_BlobInput - C# HTTP trigger function processed a request.");
  
              //Run the query against the blob to list the contents.
              BlobContinuationToken continuationToken = null;
              List&lt;IListBlobItem&gt; results = new List&lt;IListBlobItem&gt;();
              do
              {
                  var response = await myCloudBlobContainer.ListBlobsSegmentedAsync(continuationToken);
                  continuationToken = response.ContinuationToken;
                  results.AddRange(response.Results);
              }
              while (continuationToken != null);
  
              //Query the names of the blobs. Todo: can this be a single line linq query select instead?
              List&lt;string&gt; listBlobNames = new List&lt;string&gt;();
              foreach (CloudBlockBlob b in results)
              {
                  listBlobNames.Add(b.Name);
              }
  
              //Serialize the list of blob names to json for passing to function caller via return statement
              var jsonReturn = JsonConvert.SerializeObject(listBlobNames);
  
              log.LogInformation("Returning the following JSON");
              log.LogInformation(jsonReturn);
  
              return new HttpResponseMessage(HttpStatusCode.OK)
              {
                  Content = new StringContent(jsonReturn, Encoding.UTF8, "application/json")
              };
          }
      }
  }
  </code></pre>