Best Practices for Azure function for Automation of NHI Account creation in production

Hi @Kumar, Dheeraj ,

Thanks for reaching out to Microsoft Q&A.

As discussed earlier, Azure Functions can run in several hosting plans, and each has different characteristics in terms of cost, scaling, performance, and memory.

Consumption: Best for small, infrequent workloads. Cost-effective if you have low to medium usage.

Premium: Best for critical workloads needing low latency, VNET, longer execution, and more memory.

Flex Consumption: A hybrid; scales to zero like Consumption but supports higher memory and pre-warmed instances.

Dedicated / App Service: Best if you already have App Service Plan VMs and want predictable performance or hosting multiple apps together.

Cost and Memory Considerations:

• Consumption Plan
  • Memory: 1.5 GB per function instance
  • Cost: ~$0.20 per million executions + execution time
  • Cold start: Yes, can affect latency
• Premium / Flex Consumption
  • Memory: 3–14 GB per instance
  • Cost: Higher, pay for pre-warmed instances + execution
  • Cold start: No
• Dedicated / App Service
  • Memory: VM-dependent (2–32 GB or more)
  • Cost: Pay per VM/hour, whether functions run or not

How to assign required privilege to Managed identity in Graph to create certain operations like app creation, sp creation and secrets etc

This can only be achieved using PowerShell script, but not possible through Portal UI.

Use Azure AD app registration + delegated permissions

1. (If you want more control than built-in roles)
2. Create an AAD app registration representing your Function
3. Under API Permissions → Add Microsoft Graph → Application permissions:
   • Application.ReadWrite.All
   • Directory.ReadWrite.All (if you manage SPs)
   • (Optionally) AppRoleAssignment.ReadWrite.All
4. Grant admin consent
5. Assign that app registration’s service principal roles via Azure CLI/PowerShell to your Function’s managed identity
   • e.g. New-AzureADAppRoleAssignment or az ad app permission grant

C. Code snippet (PowerShell + Az module)

   
   # 1. Get the Function’s managed identity principalId
   
   $func = Get-AzWebApp -Name myFunctionApp -ResourceGroup myRG
   
   $mi  = (Get-AzUserAssignedIdentity -ResourceGroup myRG -Name myFunctionApp-identity)
   
   # 2. Assign Directory role
   
   New-AzRoleAssignment -ObjectId $mi.PrincipalId `
   
                    -RoleDefinitionName "Application Administrator" `
   
                    -Scope "/"
   

Or use Microsoft Graph SDK calls to add appRoleAssignments.

Hope this helps!

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know