Storage Policy Exception Needed for Creating Elastic Premium Function App

Varsha Vishwakarma (AVANADE INC) 120 Microsoft External Staff

I’m trying to create an Elastic Premium Azure Function App

The deployment fails with:

RequestDisallowedByPolicy Policy: SFI_XXXXX_StoXXXXXXcSS (SFI-ID4.2.1 - Storage Accounts - Safe Secrets Standard) Reason: "This configuration is not compliant. Please Refer to https://aka.ms/safesecretsstandard for support."

When creating the Function, the portal:

can’t create a new storage account (denied by that policy), and

doesn’t show existing storage accounts as valid choices either (Existing storage account is compliant with the policy)

Help me with the next steps to resolve the issue

Varsha Vishwakarma (AVANADE INC) 120 Reputation points Microsoft External Staff

2025-11-21T16:48:23.7366667+00:00

Praveen Kumar Gudipudi Thanks, this helps. with ARM, I created an Elastic Premium Function App.
Praveen Kumar Gudipudi 1,500 Reputation points Microsoft External Staff Moderator

2025-11-26T09:17:29.4266667+00:00

Hello Varsha Vishwakarma,

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

Answer accepted by question author

Praveen Kumar Gudipudi 1,500 Reputation points Microsoft External Staff Moderator

2025-11-20T12:57:18.0166667+00:00
Hello Varsha Vishwakarma,

Error is saying the subscription is under a Safe Secrets Standard policy that enforces strict storage account compliance.

The policy SFI_XXXXXXX_StXXXXXXXXSS likely enforces:

Disabling shared keys or requiring Microsoft Entra ID authentication.

Private endpoints only (no public network access).

Possibly customer-managed keys for encryption.

When these conditions aren’t met, the portal blocks both creation and selection.

To bypass this error use ARM/Bicep or CLI instead of Portal

The portal cannot override policy restrictions. You can:

Deploy via ARM template or Bicep and explicitly reference an existing compliant storage account.

Add required app settings: WEBSITE_CONTENTAZUREFILECONNECTIONSTRING = <connection string> WEBSITE_CONTENTSHARE = <file share name> WEBSITE_CONTENTOVERVNET = 1 Ensure the storage account has Azure Files enabled and allows the Function App to create a file share.

Please accept as answer and do a Thumbs-up to upvote this response if you are satisfied with the community help. Your upvote will be beneficial for the community users facing similar issues.
Please sign in to rate this answer.

2 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

0 additional answers

Your answer