Unable to set unauthenticatedClientAction with Az module or Az/CLI - azure

Question

I designed a PowerShell script that it's able to properly configure various settings of a Function App (including CORS e.g.).
The Function App works and can be called from an Api Manegement service.
When the need arose to configure Azure AD, I've used Az/CLI to replicate exactly what I do using Portal UI (and what I set manually perfectly works).
But it stopped working, APIM returns HTTP status code 401 (unauthorized).
The part of the script that configures Azure AD is the following:
# $add is a simple class that contains value to be configured
# actually AllowedTokens is always empty
if ($aad) {
'Setting Function App AAD configuration.' | Write-Verbose
$allowedTokens = if ($aad.AllowedTokens) { "--aad-allowed-token-audiences $($aad.AllowedTokens -join ' ')" } else { '' }
"az webapp auth update --name $name --resource-group $group --enabled $($aad.Enabled.ToString().ToLower())" +
" --action LoginWithAzureActiveDirectory --aad-client-id $($aad.ClientId) --aad-client-secret $($aad.ClientSecret)" +
" --token-store true" +
" --aad-token-issuer-url $($aad.TokenIssuerUrl) $allowedTokens" |
Invoke-Expression
'Function App AAD configuration set.' | Write-Verbose
}
The first strange thing is that if I disable authentication/authorization,
I save settings, enable and save again everything start working.
So I've started again and launched the script. I've examined the resource.
az auth show says that unauthenticatedClientAction is set to RedirectToLoginpage.
az resource show says that unauthenticatedClientAction is set to null.
When I do the trick described above:
az auth show says that unauthenticatedClientAction is set to AllowAnonymous.
az resource show says that unauthenticatedClientAction is set to null.
So I think this is the important difference to make the Function App properly works (or better this is the way to properly configure it).
Since I've used this method with success for other settings, I've tried to set this property with Az/CLI:
az resource update --name web --resource-group $group --namespace Microsoft.Web --resource-type config `
--parent "sites/$funcName" --set properties.siteAuthSettings.unauthenticatedClientAction=AllowAnonymous
The JSON returned as response shows nothing changed. Inspecting the resource confirms it.
One more thing, when I export the resource group I can't see any unauthenticatedClientAction in any Function App template.
What's the correct way to set unauthenticatedClientAction to AllowAnonymous?
Any help will be really appreciated!

Answer 1

First, answer your question, to set unauthenticatedClientAction to AllowAnonymous, just use
az webapp auth update --name <functionapp-name> --resource-group <group-name> --action AllowAnonymous
Actually, when you do the trick in the portal, it will change the
to
This is the unauthenticatedClientAction setting.
Then the question is coming, I am not sure if you want to secure your azure function with Azure AD or not. Because when you set unauthenticatedClientAction to AllowAnonymous, your function will allow the anonymous request, the Azure AD auth will not take effect.
When the need arose to configure Azure AD, I've used Az/CLI to replicate exactly what I do using Portal UI (and what I set manually perfectly works). But it stopped working, APIM returns HTTP status code 401 (unauthorized).
Yes, the 401 error represents the Azure AD auth toke effect, if you enable the Azure AD auth(set Log in with Azure Active Directory), you need to get the access token for your client/user, then use the token to access the function. (Not sure how to implement it in APIM, I am not an expert in APIM:-))
For more details, you could check this blog and this post.