Errors in az cli when trying to set/get ContainerApp function keys

Question

Errors in az cli when trying to set/get ContainerApp function keys

Stepan Hlushak 0

Hi,

I have recently started experimentation by deploying the azure function app into the azure container app. I used the following documentation:
https://learn.microsoft.com/en-us/azure/container-apps/functions-usage?pivots=azure-cli

and managed to deploy it successfully. Unfortunately, I can't use my web function as they return that I am not authorized "HTTP Error 401: Unauthorized".

So, I tried to set/list function keys to use them in the x-functions-key header, but got following error:

$ az containerapp function keys list --resource-group $rg --name $func_contapp_name --key-type hostKey

Command group 'containerapp function keys' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Connecting...

{

"error": {

"$id": "2",

"code": "UnexpectedException",

"message": "Unexpected exception System.InvalidOperationException: Failed to get or create ephemeral container."

}

How can I set/retrieve the function keys from the container app if az cli does not work?

Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-09T17:30:58.43+00:00
Hi @Stepan Hlushak ,

Thanks for reaching out to Microsoft Q&A.

The “failed to get or create ephemeral container” error usually means the CLI can't spin up that temporary exec container to call into your Function host.

The preview az containerapp function keys commands depend on:

Having at least one running replica (not scaled to 0)

If your app is in multiple revision mode, you must supply the --revision name

If you’re in single revision mode, it will pick the only active revision

Here are a few steps you can try:

Make sure you have a live replica

If you’ve autoscaled down to zero, bump it up to at least 1 replica (via the portal or az containerapp update … --set template.scale.minReplicas=1)

Pass the revision name (if in multiple-mode)

First list your revisions:

az containerapp revision list \ --resource-group $rg \ --name $func_contapp_name \ -o table
• Then include --revision <revisionName> when you list or set keys:
az containerapp function keys list \ --resource-group $rg \ --name $func_contapp_name \ --revision myActiveRevision \ --key-type hostKey

Use the Azure Portal

In your Container App’s Functions blade =>Manage, you can view and regenerate hostKeys or functionKeys without touching CLI.

Fall back to the ARM REST API

Host‐level keys:

az rest \ --method POST \ --url "https://management.azure.com/subscriptions/$subId/resourceGroups/$rg/providers/Microsoft.App/containerApps/$func_contapp_name/listFunctionsHostKeys?api-version=2022-03-01"

Function‐specific keys (for function foo):

az rest \ --method POST \ --url "https://management.azure.com/subscriptions/$subId/resourceGroups/$rg/providers/Microsoft.App/containerApps/$func_contapp_name/functions/foo/listKeys?api-version=2022-03-01"

Hope this helps!

References:

Manage function keys in Container Apps

az containerapp function keys CLI

Stepan Hlushak 0

Hi Pravallika,

Thanks for your suggestions.

I have tried them and they don't work, unfortunately. The second one still fails after I specify revision. It fails in 3 different ways :) :

1.

ACTIVEREVISION=$( az containerapp revision list \
--resource-group $rg \
--name $func_contapp_name \
--query "[0].name" )
az containerapp function keys list --resource-group $rg --name $func_contapp_name --key-type hostKey --revision ${ACTIVEREVISION//"/}

Command group 'containerapp function keys' is in preview and under development. Reference and support levels: 
Connecting...
{
"error": {
"$id": "2",
"code": "UnexpectedException",
"message": "Unexpected exception System.Net.WebSockets.WebSocketException: Unexpected exception System.Net.WebSockets.WebSocketException: The remote party closed the WebSocket connection without completing the close handshake..."
}
}

ACTIVEREVISION=$( az containerapp revision list \
--resource-group $rg \
--name $func_contapp_name \
--query "[0].name" )
az containerapp function keys list --resource-group $rg --name $func_contapp_name --key-type hostKey --revision ${ACTIVEREVISION//"/}

Command group 'containerapp function keys' is in preview and under development. Reference and support levels: 
Connecting...
{
"error": {
"$id": "2",
"code": "UnexpectedException",
"message": "Unexpected exception System.Net.WebSockets.WebSocketException: Unexpected exception System.Net.WebSockets.WebSocketException: The server returned status code '500' when status code '101' was expected..."
}
}

$ ACTIVEREVISION=$( az containerapp revision list \
--resource-group $rg \
--name $func_contapp_name \
--query "[0].name" )
az containerapp function keys list --resource-group $rg --name $func_contapp_name --key-type hostKey --revision ${ACTIVEREVISION//"/}

Command group 'containerapp function keys' is in preview and under development. Reference and support levels: 
Connecting...
{
  "error": {
"$id": "2",
"code": "UnexpectedException",
"message": "Unexpected exception System.InvalidOperationException: Failed to get or create ephemeral container."
}
}

The THIRD suggestion is also not working form me, as I cant find the Functions tab on the left menu in the portal when I get into the container app page.

The FOURTH suggestion fails because the url seems to be wrong ("Not Found" is displayed). I have tried multiple modifications of REST urls:

$ az rest \
--method GET \
--url "https://management.azure.com/subscriptions/$subscription/resourceGroups/$rg/providers/Microsoft.App/containerApps/$func_contapp_name/listFunctionsHostKeys?api-version=2022-03-01"
Not Found

$ az rest \
--method GET \
--url "https://management.azure.com/subscriptions/$subscription/resourceGroups/$rg/providers/Microsoft.App/containerApps/$func_contapp_name/functions/functionsname/listKeys?api-version=2022-03-01"
Not Found

$ az rest \
--method GET \
--url "https://management.azure.com/subscriptions/$subscription/resourceGroups/$rg/providers/Microsoft.App/containerApps/$func_contapp_name/functions/FUNCTIONNAME/listKeys?api-version=2025-10-02-preview"
Not Found

$ az rest \
--method GET \
--url "https://management.azure.com/subscriptions/$subscription/resourceGroups/$rg/providers/Microsoft.App/containerApps/$func_contapp_name/functions/FUNCTIONNAME/keys?api-version=2025-10-02-preview"
Not Found

Can you somehow get me the exact URL to get these key using REST, because the

az rest \
--method GET \
--url "https://management.azure.com/subscriptions/$subscription/resourceGroups/$rg/providers/Microsoft.App/containerApps/$func_contapp_name/functions?api-version=2025-10-02-preview"

worked fine?

Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-09T21:11:48.2166667+00:00
@Stepan Hlushak , you can list function keys for a specific function in an Azure Functions on Container Apps using below command, refer MSDOC:

az containerapp function keys list -n my-containerapp -g MyResourceGroup --key-type functionKey --function-name MyFunctionName

Stepan Hlushak 0

Fails again. Here are the failing outputs:

az containerapp function keys list -n $func_contapp_name -g $rg --key-type functionKey --function-name FUNCNAME
Command group 'containerapp function keys' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Connecting...
"[ERROR] Command failed: request failed with status 500 after 3 attempts:"

az containerapp function keys list -n $func_contapp_name -g $rg --key-type functionKey --function-name FUNCNAME
Command group 'containerapp function keys' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Connecting...
Error retrieving function keys of type 'functionKey'.

Can it fail because I am using python functions of v1 kind with every function code in separate folder?

Pravallika KV 12,575 Microsoft External Staff Moderator

This looks like server-side issue. Could you please try debugging using below command:

az containerapp function keys list -n $func_contapp_name -g $rg --key-type functionKey --function-name ClarityDXProstateRiskScore --debug

If the CLI fails, you can try below REST API endpoint:

GET
https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.Web/containerApps/{appName}/functions/{functionName}/listKeys?api-version=2023-10-01

Stepan Hlushak 0

Fails again. Here are the failing outputs:

az containerapp function keys list -n $func_contapp_name -g $rg --key-type functionKey --function-name ClarityDXProstateRiskScore
Command group 'containerapp function keys' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Connecting...
"[ERROR] Command failed: request failed with status 500 after 3 attempts:"

az containerapp function keys list -n $func_contapp_name -g $rg --key-type functionKey --function-name ClarityDXProstateRiskScore
Command group 'containerapp function keys' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Connecting...
Error retrieving function keys of type 'functionKey'.

Can it fail because I am using python functions v1 kind with every function code in separate folder?

Stepan Hlushak 0

Yes. Sure. Please find attached the log file output of the first command

log.txt

The Second Command failed with:

$ az rest \
--method GET \
--url "https://management.azure.com/subscriptions/$subscription/resourceGroups/$rg/providers/Microsoft.Web/containerApps/$func_contapp_name/functions/ClarityDXProstateRiskScore/listKeys?api-version=2023-10-01"

Not Found({"error":{"code":"ResourceNotFound","message":"The Resource 'Microsoft.Web/containerApps/claritydxus2-prstt-fnc-cntapp' under resource group 'ClarityDX_Prostate_US_RG' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"}})

Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-10T03:35:47.3666667+00:00
Thanks for sharing the log. I will check and update you.

Could you please confirm which Azure CLI version you're using?

The containerapp function keys commands are still unstable. This reference is part of the containerapp extension for the Azure CLI (version 2.79.0 or higher).

az upgrade az extension update --name containerapp
Stepan Hlushak 0 Reputation points

2026-03-10T15:39:05.3733333+00:00

Here is my az cli version

azure-cli 2.83.0

core 2.83.0

telemetry 1.1.0

Extensions:

application-insights 1.2.3

azure-devops 1.0.2

containerapp 1.3.0b3

scheduled-query 1.0.0b1

sentinel 0.2.0

Dependencies:

msal 1.35.0b1

azure-mgmt-resource 23.3.0

Python location '/opt/az/bin/python3'

Config directory '/home/step/.azure'

Extensions directory '/home/step/.azure/cliextensions'

Python (Linux) 3.13.11 (main, Jan 27 2026, 07:21:51) [GCC 11.4.0]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Stepan Hlushak 0

Maybe I am deploying it in some wrong way? Here is my deploy command:

az containerapp create \
  --resource-group $rg \
  --name $func_contapp_name \
  --environment $func_contapp_env_name \
  --image ${container_registry_name}.azurecr.io/nanostics/${func_contapp_image_name}  --cpu 4 --memory 8 \
  --registry-server ${container_registry_name}.azurecr.io \
  --registry-username $container_registry_name \
  --registry-password $ACR_PASSWORD \
  --min-replicas 1 \
  --max-replicas 4 \
  --ingress external \
  --target-port 80 \
  --kind functionapp \
  --query properties.outputs.fqdn

Stepan Hlushak 0

Also, here is my Docker file

# To enable ssh & remote debugging on app service change the base image to the one below
# FROM mcr.microsoft.com/azure-functions/python:4-python3.10-appservice
# FROM mcr.microsoft.com/azure-functions/python:4-python3.10
FROM mcr.microsoft.com/azure-functions/python:4-python3.13-appservice
# https://hub.docker.com/r/microsoft/azure-functions-python
ENV AzureWebJobsScriptRoot=/home/site/wwwroot \
    AzureFunctionsJobHost__Logging__Console__IsEnabled=true
COPY requirements.txt /
RUN pip install -r /requirements.txt
COPY . /home/site/wwwroot

Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-10T20:00:57.9933333+00:00
Could you please run below command and check if it fails:

az containerapp exec \ -n claritydxus2-prstt-fnc-cntapp \ -g ClarityDX_Prostate_US_RG \ --command "/bin/sh"
Stepan Hlushak 0 Reputation points

2026-03-10T22:12:08.5333333+00:00

It works. Looks like I have opened shell inside the container of the app! Should I run anything inside?
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-10T22:32:58.0166667+00:00
Yes, try running below commands in the shell:

which azure-functions-admin

azure-functions-admin functions list

azure-functions-admin keys list --function-name ClarityDXProstateRiskScore

Stepan Hlushak 0

Looks like azure-function-admin command is not in the container. I have used

mcr.microsoft.com/azure-functions/python:4-python3.13-appservice

container as a starting point

$ az containerapp exec \
  -n claritydxus2-prstt-fnc-cntapp \
  -g ClarityDX_Prostate_US_RG \
  --command "/bin/sh"
INFO: Connecting to the container 'claritydxus2-prstt-fnc-cntapp'...
Use ctrl + D to exit.
INFO: Successfully connected to container: 'claritydxus2-prstt-fnc-cntapp'. [ Revision: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm', Replica: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm-7fcc8f95c7-9ntx2'].
# which azure-functions-admin
# 
# which azure-functions-admin
# azure-functions-admin functions list
/bin/sh: 4: azure-functions-admin: not found
# azure-functions-admin keys list --function-name ClarityDXProstateRiskScore
/bin/sh: 5: azure-functions-admin: not found
# INFO: received success status from cluster
Disconnecting...

Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-10T23:08:15.2666667+00:00
Run these exact commands inside the container shell:

ls /home/data/Functions/secrets

cat /home/data/Functions/secrets/ClarityDXProstateRiskScore.json

Stepan Hlushak 0

These folders do not exist in the container:

az containerapp exec \
  -n claritydxus2-prstt-fnc-cntapp \
  -g ClarityDX_Prostate_US_RG \
  --command "/bin/sh"
INFO: Connecting to the container 'claritydxus2-prstt-fnc-cntapp'...
Use ctrl + D to exit.
INFO: Successfully connected to container: 'claritydxus2-prstt-fnc-cntapp'. [ Revision: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm', Replica: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm-c9ffc5b54-ktws4'].
# ls /home/data/Functions/secrets
ls: cannot access '/home/data/Functions/secrets': No such file or directory
# cat /home/data/Functions/secrets/ClarityDXProstateRiskScore.json
cat: /home/data/Functions/secrets/ClarityDXProstateRiskScore.json: No such file or directory
# ls /home/data/Functions
ls: cannot access '/home/data/Functions': No such file or directory
# ls /home
app  site
# ls /home/app
# ls /home/site
wwwroot
# ls /home/site/wwwroot
7b2abbfee3814e23a5d438d87f972d52_Dockerfile  requirements.txt
  Dockerfile			   Logos				     chart_gen.py     deploy.sh		host.json	  tests
  pie_gen.py Fonts				   Report_Data_FRA.csv			     constants_us.sh  function_app.py	report_gen_V4.py
# ls /home
app  site
# ls /home/app
#

Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-11T23:15:14.7+00:00
The preview Azure CLI command az containerapp function keys list tries to connect to this same runtime API internally, but the integration with Azure Container Apps is still unstable, which is why you’re seeing HTTP 500 errors.

In Azure Functions running in Azure Container Apps, the function keys are stored in the Functions runtime memory / internal storage, so you won’t see them in /home.

Call the Functions runtime admin API instead:

curl http://localhost:80/admin/host/keys

For a specific function:

curl http://localhost:80/admin/functions/ClarityDXProstateRiskScore/keys

If auth is required, include the master key:

curl -H "x-functions-key: <masterKey>" \
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-12T22:46:17.54+00:00

@Stepan Hlushak ,following up to see if the above information was helpful. Please let me know if you have any questions.

Stepan Hlushak 0

I have tried to get keys from the urls, and it still does not work for some reason (does not return anything):

$ az containerapp exec   -n claritydxus2-prstt-fnc-cntapp   -g ClarityDX_Prostate_US_RG   --command "/bin/sh"
INFO: Connecting to the container 'claritydxus2-prstt-fnc-cntapp'...
Use ctrl + D to exit.
INFO: Successfully connected to container: 'claritydxus2-prstt-fnc-cntapp'. [ Revision: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm', Replica: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm-c9ffc5b54-ktws4'].
# curl http://localhost:80/admin/host/keys
# curl http://localhost:80/admin/functions/ClarityDXProstateRiskScore/keys
# 
# curl http://localhost:80/admin/host/keys
# curl http://localhost:80/admin/functions/ClarityDXProstateRiskScore/keys
# curl http://localhost:80/admin/functions/ClarityDXProstateRiskScore     
# curl http://localhost:80/api/ClarityDXProstateRiskScore

Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-16T23:07:27.68+00:00

@Stepan Hlushak ,I have reached out to you over private message, could you please check and provide the requested information for further troubleshoot?
Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2026-03-18T10:14:57.5733333+00:00

Hello Stepan Hlushak,

Based on the behavior observed and current platform limitations, Azure Functions running inside Azure Container Apps do not provide a fully supported or stable mechanism for managing or retrieving function keys.

Key Findings

The az containerapp function keys commands are still in preview and currently unreliable, often failing with 500 errors or runtime exceptions.

The Azure Portal experience (Function Keys blade) is not available for Container Apps.

ARM/REST APIs for function keys are inconsistent or not fully implemented for this scenario.

Function keys are managed internally by the Functions runtime, and may not be accessible via filesystem or standard endpoints.

Even direct runtime API calls (/admin/host/keys) may not return results depending on runtime state/configuration.

Conclusion

At this time, function key management should not be relied upon when hosting Azure Functions in Azure Container Apps, as it is not a fully supported or stable feature.

Please try below approach:

Option 1 – Preferred (Production)

Implement external authentication/authorization instead of function keys:

Azure AD (Microsoft Entra ID)

API Management in front of the Container App

Custom JWT/token-based authentication

This aligns with Container Apps’ design and provides a more robust and secure solution.

Option 2 – For Testing / Temporary Use

Set your HTTP trigger to:

AuthorizationLevel.Anonymous

This allows you to invoke the function without keys while testing.

Option 3 – If Function Keys Are Required

Use a standard Azure Function App (Consumption or Premium plan) instead of Container Apps, where:

Function keys are fully supported

CLI, portal, and REST APIs work reliably
Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2026-03-23T07:08:00.0566667+00:00

Hello Stepan Hlushak,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

2 answers

Your answer

Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-09T17:30:58.43+00:00

Hi @Stepan Hlushak ,

Thanks for reaching out to Microsoft Q&A.

The “failed to get or create ephemeral container” error usually means the CLI can't spin up that temporary exec container to call into your Function host.

The preview az containerapp function keys commands depend on:

Having at least one running replica (not scaled to 0)

If your app is in multiple revision mode, you must supply the --revision name

If you’re in single revision mode, it will pick the only active revision

Here are a few steps you can try:

Make sure you have a live replica

If you’ve autoscaled down to zero, bump it up to at least 1 replica (via the portal or az containerapp update … --set template.scale.minReplicas=1)

Pass the revision name (if in multiple-mode)

First list your revisions:

az containerapp revision list \ --resource-group $rg \ --name $func_contapp_name \ -o table
• Then include --revision <revisionName> when you list or set keys:
az containerapp function keys list \ --resource-group $rg \ --name $func_contapp_name \ --revision myActiveRevision \ --key-type hostKey

Use the Azure Portal

In your Container App’s Functions blade =>Manage, you can view and regenerate hostKeys or functionKeys without touching CLI.

Fall back to the ARM REST API

Host‐level keys:

az rest \ --method POST \ --url "https://management.azure.com/subscriptions/$subId/resourceGroups/$rg/providers/Microsoft.App/containerApps/$func_contapp_name/listFunctionsHostKeys?api-version=2022-03-01"

Function‐specific keys (for function foo):

az rest \ --method POST \ --url "https://management.azure.com/subscriptions/$subId/resourceGroups/$rg/providers/Microsoft.App/containerApps/$func_contapp_name/functions/foo/listKeys?api-version=2022-03-01"

Hope this helps!

References:

Manage function keys in Container Apps

az containerapp function keys CLI
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-09T21:11:48.2166667+00:00

@Stepan Hlushak , you can list function keys for a specific function in an Azure Functions on Container Apps using below command, refer MSDOC:

az containerapp function keys list -n my-containerapp -g MyResourceGroup --key-type functionKey --function-name MyFunctionName
Stepan Hlushak 0 Reputation points

2026-03-09T21:25:25.79+00:00

Fails again. Here are the failing outputs:

az containerapp function keys list -n $func_contapp_name -g $rg --key-type functionKey --function-name FUNCNAME Command group 'containerapp function keys' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus Connecting... "[ERROR] Command failed: request failed with status 500 after 3 attempts:" az containerapp function keys list -n $func_contapp_name -g $rg --key-type functionKey --function-name FUNCNAME Command group 'containerapp function keys' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus Connecting... Error retrieving function keys of type 'functionKey'.

Can it fail because I am using python functions of v1 kind with every function code in separate folder?
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-09T21:31:24.72+00:00

This looks like server-side issue. Could you please try debugging using below command:

az containerapp function keys list -n $func_contapp_name -g $rg --key-type functionKey --function-name ClarityDXProstateRiskScore --debug

If the CLI fails, you can try below REST API endpoint:

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.Web/containerApps/{appName}/functions/{functionName}/listKeys?api-version=2023-10-01
Stepan Hlushak 0 Reputation points

2026-03-10T00:19:05.6833333+00:00

Fails again. Here are the failing outputs:

az containerapp function keys list -n $func_contapp_name -g $rg --key-type functionKey --function-name ClarityDXProstateRiskScore Command group 'containerapp function keys' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus Connecting... "[ERROR] Command failed: request failed with status 500 after 3 attempts:" az containerapp function keys list -n $func_contapp_name -g $rg --key-type functionKey --function-name ClarityDXProstateRiskScore Command group 'containerapp function keys' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus Connecting... Error retrieving function keys of type 'functionKey'.

Can it fail because I am using python functions v1 kind with every function code in separate folder?
Stepan Hlushak 0 Reputation points

2026-03-10T02:17:52.88+00:00

Yes. Sure. Please find attached the log file output of the first command

log.txt

The Second Command failed with:

$ az rest \ --method GET \ --url "https://management.azure.com/subscriptions/$subscription/resourceGroups/$rg/providers/Microsoft.Web/containerApps/$func_contapp_name/functions/ClarityDXProstateRiskScore/listKeys?api-version=2023-10-01" Not Found({"error":{"code":"ResourceNotFound","message":"The Resource 'Microsoft.Web/containerApps/claritydxus2-prstt-fnc-cntapp' under resource group 'ClarityDX_Prostate_US_RG' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"}})
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-10T03:35:47.3666667+00:00

Thanks for sharing the log. I will check and update you.

Could you please confirm which Azure CLI version you're using?

The containerapp function keys commands are still unstable. This reference is part of the containerapp extension for the Azure CLI (version 2.79.0 or higher).

az upgrade az extension update --name containerapp
Stepan Hlushak 0 Reputation points

2026-03-10T15:39:05.3733333+00:00

Here is my az cli version

azure-cli 2.83.0

core 2.83.0

telemetry 1.1.0

Extensions:

application-insights 1.2.3

azure-devops 1.0.2

containerapp 1.3.0b3

scheduled-query 1.0.0b1

sentinel 0.2.0

Dependencies:

msal 1.35.0b1

azure-mgmt-resource 23.3.0

Python location '/opt/az/bin/python3'

Config directory '/home/step/.azure'

Extensions directory '/home/step/.azure/cliextensions'

Python (Linux) 3.13.11 (main, Jan 27 2026, 07:21:51) [GCC 11.4.0]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.
Stepan Hlushak 0 Reputation points

2026-03-10T19:53:21.85+00:00

Maybe I am deploying it in some wrong way? Here is my deploy command:

az containerapp create \ --resource-group $rg \ --name $func_contapp_name \ --environment $func_contapp_env_name \ --image ${container_registry_name}.azurecr.io/nanostics/${func_contapp_image_name} --cpu 4 --memory 8 \ --registry-server ${container_registry_name}.azurecr.io \ --registry-username $container_registry_name \ --registry-password $ACR_PASSWORD \ --min-replicas 1 \ --max-replicas 4 \ --ingress external \ --target-port 80 \ --kind functionapp \ --query properties.outputs.fqdn
Stepan Hlushak 0 Reputation points

2026-03-10T19:54:35.5266667+00:00

Also, here is my Docker file

# To enable ssh & remote debugging on app service change the base image to the one below # FROM mcr.microsoft.com/azure-functions/python:4-python3.10-appservice # FROM mcr.microsoft.com/azure-functions/python:4-python3.10 FROM mcr.microsoft.com/azure-functions/python:4-python3.13-appservice # https://hub.docker.com/r/microsoft/azure-functions-python ENV AzureWebJobsScriptRoot=/home/site/wwwroot \ AzureFunctionsJobHost__Logging__Console__IsEnabled=true COPY requirements.txt / RUN pip install -r /requirements.txt COPY . /home/site/wwwroot
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-10T20:00:57.9933333+00:00

Could you please run below command and check if it fails:

az containerapp exec \ -n claritydxus2-prstt-fnc-cntapp \ -g ClarityDX_Prostate_US_RG \ --command "/bin/sh"
Stepan Hlushak 0 Reputation points

2026-03-10T22:12:08.5333333+00:00

It works. Looks like I have opened shell inside the container of the app! Should I run anything inside?
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-10T22:32:58.0166667+00:00

Yes, try running below commands in the shell:

which azure-functions-admin

azure-functions-admin functions list

azure-functions-admin keys list --function-name ClarityDXProstateRiskScore
Stepan Hlushak 0 Reputation points

2026-03-10T22:54:22.5166667+00:00

Looks like azure-function-admin command is not in the container. I have used

mcr.microsoft.com/azure-functions/python:4-python3.13-appservice

container as a starting point

$ az containerapp exec \ -n claritydxus2-prstt-fnc-cntapp \ -g ClarityDX_Prostate_US_RG \ --command "/bin/sh" INFO: Connecting to the container 'claritydxus2-prstt-fnc-cntapp'... Use ctrl + D to exit. INFO: Successfully connected to container: 'claritydxus2-prstt-fnc-cntapp'. [ Revision: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm', Replica: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm-7fcc8f95c7-9ntx2']. # which azure-functions-admin # # which azure-functions-admin # azure-functions-admin functions list /bin/sh: 4: azure-functions-admin: not found # azure-functions-admin keys list --function-name ClarityDXProstateRiskScore /bin/sh: 5: azure-functions-admin: not found # INFO: received success status from cluster Disconnecting...
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-10T23:08:15.2666667+00:00

Run these exact commands inside the container shell:

ls /home/data/Functions/secrets

cat /home/data/Functions/secrets/ClarityDXProstateRiskScore.json
Stepan Hlushak 0 Reputation points

2026-03-11T16:35:38.38+00:00

These folders do not exist in the container:

az containerapp exec \ -n claritydxus2-prstt-fnc-cntapp \ -g ClarityDX_Prostate_US_RG \ --command "/bin/sh" INFO: Connecting to the container 'claritydxus2-prstt-fnc-cntapp'... Use ctrl + D to exit. INFO: Successfully connected to container: 'claritydxus2-prstt-fnc-cntapp'. [ Revision: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm', Replica: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm-c9ffc5b54-ktws4']. # ls /home/data/Functions/secrets ls: cannot access '/home/data/Functions/secrets': No such file or directory # cat /home/data/Functions/secrets/ClarityDXProstateRiskScore.json cat: /home/data/Functions/secrets/ClarityDXProstateRiskScore.json: No such file or directory # ls /home/data/Functions ls: cannot access '/home/data/Functions': No such file or directory # ls /home app site # ls /home/app # ls /home/site wwwroot # ls /home/site/wwwroot 7b2abbfee3814e23a5d438d87f972d52_Dockerfile requirements.txt Dockerfile Logos chart_gen.py deploy.sh host.json tests pie_gen.py Fonts Report_Data_FRA.csv constants_us.sh function_app.py report_gen_V4.py # ls /home app site # ls /home/app #
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-11T23:15:14.7+00:00

The preview Azure CLI command az containerapp function keys list tries to connect to this same runtime API internally, but the integration with Azure Container Apps is still unstable, which is why you’re seeing HTTP 500 errors.

In Azure Functions running in Azure Container Apps, the function keys are stored in the Functions runtime memory / internal storage, so you won’t see them in /home.

Call the Functions runtime admin API instead:

curl http://localhost:80/admin/host/keys

For a specific function:

curl http://localhost:80/admin/functions/ClarityDXProstateRiskScore/keys

If auth is required, include the master key:

curl -H "x-functions-key: <masterKey>" \
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-12T22:46:17.54+00:00

@Stepan Hlushak ,following up to see if the above information was helpful. Please let me know if you have any questions.
Stepan Hlushak 0 Reputation points

2026-03-13T15:53:46.3+00:00

I have tried to get keys from the urls, and it still does not work for some reason (does not return anything):

$ az containerapp exec -n claritydxus2-prstt-fnc-cntapp -g ClarityDX_Prostate_US_RG --command "/bin/sh" INFO: Connecting to the container 'claritydxus2-prstt-fnc-cntapp'... Use ctrl + D to exit. INFO: Successfully connected to container: 'claritydxus2-prstt-fnc-cntapp'. [ Revision: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm', Replica: 'claritydxus2-prstt-fnc-cntapp--bz4fnzm-c9ffc5b54-ktws4']. # curl http://localhost:80/admin/host/keys # curl http://localhost:80/admin/functions/ClarityDXProstateRiskScore/keys # # curl http://localhost:80/admin/host/keys # curl http://localhost:80/admin/functions/ClarityDXProstateRiskScore/keys # curl http://localhost:80/admin/functions/ClarityDXProstateRiskScore # curl http://localhost:80/api/ClarityDXProstateRiskScore
Pravallika KV 12,575 Reputation points Microsoft External Staff Moderator

2026-03-16T23:07:27.68+00:00

@Stepan Hlushak ,I have reached out to you over private message, could you please check and provide the requested information for further troubleshoot?
Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2026-03-18T10:14:57.5733333+00:00

Hello Stepan Hlushak,

Based on the behavior observed and current platform limitations, Azure Functions running inside Azure Container Apps do not provide a fully supported or stable mechanism for managing or retrieving function keys.

Key Findings

The az containerapp function keys commands are still in preview and currently unreliable, often failing with 500 errors or runtime exceptions.

The Azure Portal experience (Function Keys blade) is not available for Container Apps.

ARM/REST APIs for function keys are inconsistent or not fully implemented for this scenario.

Function keys are managed internally by the Functions runtime, and may not be accessible via filesystem or standard endpoints.

Even direct runtime API calls (/admin/host/keys) may not return results depending on runtime state/configuration.

Conclusion

At this time, function key management should not be relied upon when hosting Azure Functions in Azure Container Apps, as it is not a fully supported or stable feature.

Please try below approach:

Option 1 – Preferred (Production)

Implement external authentication/authorization instead of function keys:

Azure AD (Microsoft Entra ID)

API Management in front of the Container App

Custom JWT/token-based authentication

This aligns with Container Apps’ design and provides a more robust and secure solution.

Option 2 – For Testing / Temporary Use

Set your HTTP trigger to:

AuthorizationLevel.Anonymous

This allows you to invoke the function without keys while testing.

Option 3 – If Function Keys Are Required

Use a standard Azure Function App (Consumption or Premium plan) instead of Container Apps, where:

Function keys are fully supported

CLI, portal, and REST APIs work reliably
Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2026-03-23T07:08:00.0566667+00:00

Hello Stepan Hlushak,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

Hello Stepan Hlushak,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having errors in az cli when trying to set/get ContainerApp function keys.

First, ensure the Container App is actively running by forcing at least one replica using

az containerapp update --name <app> --resource-group <rg> --set template.scale.minReplicas=1

Then confirm an active revision exists with az containerapp revision list -o table, as required in Microsoft Docs: https://learn.microsoft.com/azure/container-apps/scale-app.

Next, verify the Function host inside the container is fully initialized, since CLI operations depend on it.

az containerapp logs show --name <app> --resource-group <rg>

Check for “Host started” in logs, aligning with diagnostics guidance: https://learn.microsoft.com/azure/container-apps/logging.

After that, retrieve the active revision name because multi-revision apps require explicit targeting.

REVISION=$(az containerapp revision list --name <app> --resource-group <rg> --query "[?properties.active].name" -o tsv)

This ensures the CLI interacts with the correct running revision per revision management docs.

Then execute the CLI command only after validation steps are satisfied.

az containerapp function keys list --name <app> --resource-group <rg> --revision $REVISION --key-type hostKeys

If prerequisites are unmet, the command fails due to runtime dependency as documented in Azure CLI references.

Finally, if the CLI still fails, switch to the REST API which bypasses runtime execution entirely.

az rest --method POST --url "https://management.azure.com/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.App/containerApps/<app>/functions/admin/host/keys?api-version=2024-03-01"

This direct management-plane call is the most reliable method per Azure REST API guidance: https://learn.microsoft.com/rest/api/resource-manager/.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

Errors in az cli when trying to set/get ContainerApp function keys

2 answers

Your answer