[functionapp] Can't use Azure CLI to Create a Function App from Within the same Script that the Storage Account was Created In

[azclibot]

Source: Azure/azure-cli#32019 (by @nlaymon1980)
Affected extension: functionapp (src/functionapp/)

---

<<UNTRUSTED:issue-32019>>

Issue #32019 (by @nlaymon1980)

Title

Can't use Azure CLI to Create a Function App from Within the same Script that the Storage Account was Created In

Body

Describe the bug

Azure cli is failing to create a function app using an EP1 App Service Plan from within the same script that creates the associated storage account. We are receiving the following error

ERROR: Creation of storage file share failed with: 'The remote server returned an error: (403) Forbidden.'. Please check if the storage account is accessible.

We have verified that the network rules of the storage account allow the VNet of the App Service Plan and the Cloud Shell IP Address.

The only workaround found was to save the networking rules of the storage account from the Azure Portal after the storage account was created and before the function app create command.

Microsoft Case #2506050040013371 was opened for this issue.

Related command

az functionapp create -n xxx-functionapp-qa -g xxx-qa --plan xxx-fa1-l-qa --app-insights xxx-fa-qa-appinsights --storage-account xxxqa --functions-version 4 --runtime python --runtime-version 3.11 --vnet xxx-vnet-qa --subnet subnet-fa1 --https-only true --only-show-errors

Errors

ERROR: Creation of storage file share failed with: 'The remote server returned an error: (403) Forbidden.'. Please check if the storage account is accessible.

Issue script & Debug output

ERROR: Creation of storage file share failed with: 'The remote server returned an error: (403) Forbidden.'. Please check if the storage account is accessible.

Expected behavior

Function App should be created as well as the File Share in the storage account.

Environment Summary

azure-cli 2.76.0

core 2.76.0
telemetry 1.1.0

Extensions:
application-insights 1.2.3
ml 2.38.0
ssh 2.0.6

Dependencies:
msal 1.33.0b1
azure-mgmt-resource 23.3.0

Extensions system directory '/usr/lib/python3.12/site-packages/azure-cli-extensions'

Python (Linux) 3.12.9 (main, Jul 29 2025, 01:30:13) [GCC 13.2.0]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

Microsoft Case #2506050040013371 was opened for this issue.

Comments

Comment by @yonzhan

Thank you for opening this issue, we will look into it.

Comment by @microsoft-github-policy-service[bot]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @AnatoliB, @Francisco-Gamino, @shreyabatra4.

<<END:issue-32019>>

[yonzhan]

Thank you for opening this issue, we will look into it.

[azclibot]

Context for Copilot

This issue was filed on Azure/azure-cli (#32019) and routed here because it affects the functionapp extension.

Problem Summary

az functionapp create fails with a 403 Forbidden error when the associated storage account has VNet/firewall rules configured, and the function app creation happens in the same script immediately after the storage account creation.

Error:

ERROR: Creation of storage file share failed with: 'The remote server returned an error: (403) Forbidden.'. Please check if the storage account is accessible.

The root cause is that the CLI attempts to create the Azure Files share in the storage account immediately after the storage account is created — but the VNet/firewall rules on the new storage account haven't fully propagated yet, resulting in a 403.

Failing command:

az functionapp create -n <name> -g <rg> --plan <plan> --app-insights <ai> --storage-account <sa> --functions-version 4 --runtime python --runtime-version 3.11 --vnet <vnet> --subnet <subnet> --https-only true --only-show-errors

Workaround: Saving network rules from Azure Portal between the two commands resolves it.

Suggested fix: Add retry logic (with backoff) when creating the storage file share fails with 403, since this is a common race condition when storage accounts have VNet rules just applied. Alternatively, improve the error message to explain the likely cause (VNet rule propagation delay) and suggest a retry or delay.

CLI version: 2.76.0

PR title & description format (required)

This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

Title

• Start with [Functionapp] — square brackets [] for a customer-facing change (added to HISTORY.rst), curly {} if not. A bug fix is customer-facing, so use [].
• Then Fix #10029: to link the issue (use the short #N form, not owner/repo#N).
• Then the affected command wrapped in backticks followed by a colon — e.g. `az vm create`:. ⚠️ The format check fails if the az ... command in the title is not inside backticks.
• Then a present-tense, capitalized verb (Fix for bug fixes; Add/Change/Deprecate/Remove otherwise) and a concise summary.
• Recommended title (note the backticks around the command):

[Functionapp] Fix #10029: `az <command>`: Fix <concise description of the fix>

Description — follow the PR template and fill in:

• Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #10029.
• Related command — the az ... command this affects.
• Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
• Testing Guide — example command(s) showing the fix works.
• History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g. [Functionapp] `az <command>`: <note>.
• Keep the template checklist and tick the items you've satisfied.

---

Posted by agent-assist (autonomous bug-fix pipeline).