Azure Functions: StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.NSUrlSessionHandler+NSUrlSessionDataTaskStreamContent, Headers

Question

Azure Functions: StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.NSUrlSessionHandler+NSUrlSessionDataTaskStreamContent, Headers

Kim Strasser 2,536

My Azure Functions project is no more working after I updated my NuGet packages in my Visual Studio Azure Functions project. In addition, my Publishing Profile was no more displayed in Visual Studio and I have created a new profile. I´m not sure if I have the correct settings in the Publishing Profile. I had repaired Visual Studio Community 2026 yesterday with the VS installer and I have updated Visual Studio, maybe my Publishing Profile was deleted in this process. I have not changed my code in my Azure Functions project, I have only updated the NuGet packages and clicked on the Publish button to deploy to Azure.

What does this error mean? I get the error when I call one of my Azure functions on my iPad Air in debug mode.

StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.NSUrlSessionHandler+NSUrlSessionDataTaskStreamContent, Headers

Kim Strasser 2,536

It works with the following NuGet packages:

<ItemGroup>
	<FrameworkReference Include="Microsoft.AspNetCore.App" />
	<PackageReference Include="Azure.Identity" Version="1.21.0" />
	<PackageReference Include="Microsoft.ApplicationInsights.WorkerService" Version="3.1.0" />
	<PackageReference Include="Microsoft.Azure.Functions.Worker" Version="2.52.0" />
	<PackageReference Include="Microsoft.Azure.Functions.Worker.ApplicationInsights" Version="2.50.0" />
	<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http.AspNetCore" Version="2.1.0" />
	<PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="2.0.7" OutputItemType="Analyzer" />
	<PackageReference Include="OpenTelemetry.Api" Version="1.15.3" />
	<PackageReference Include="PlayFabAllSDK" Version="1.222.260410" />
</ItemGroup>

The issue was that I needed to update OpenTelemetry.Api from version 1.15.1 to version 1.15.3. Screenshot 2026-05-02 094643

But it only works when I use AuthorizationLevel.Anonymous. When I use AuthorizationLevel.Function then it doesn´t work and I get this message in my Function project in Azure Portal in Log stream:

Connected! 2026-05-03T19:58:45 [Verbose] Request successfully matched the route with name 'MyFunction1' and template 'api/MyFunction1' 2026-05-03T19:58:45 [Verbose] AuthenticationScheme: WebJobsAuthLevel was not authenticated. 2026-05-03T19:58:45 [Information] Authorization failed. These requirements were not met: Microsoft.Azure.WebJobs.Script.WebHost.Security.Authorization.FunctionAuthorizationRequirement 2026-05-03T19:58:45 [Information] Executing StatusCodeResult, setting HTTP status code 401

My Azure function:

[Function("MyFunction1")]
  public async Task<HttpResponseData> MyFunction1(
      [HttpTrigger(AuthorizationLevel.Function, "post", Route = null)] HttpRequestData req)
  {
      // Read JSON body
      string jsonStr = await new StreamReader(req.Body).ReadToEndAsync();
      Dictionary<string, string> jsonDict = JsonSerializer.Deserialize<Dictionary<string, string>>(jsonStr);
      ...
      var result = new Result
      {
      FunctionSuccessful = successful,
      ...
      };
      var response = req.CreateResponse(HttpStatusCode.OK);
      await response.WriteStringAsync(
JsonSerializer.Serialize(result, new JsonSerializerOptions
{
    PropertyNamingPolicy = JsonNamingPolicy.CamelCase
}));
        return response;
    }

I don´t know why AuthorizationLevel.Function is not working.

It works now when I use AuthorizationLevel.Function. I didn´t use my Azure function´s key before.

Answer accepted by question author

3 additional answers

Your answer

Answer 1

Hi @Kim Strasser ,

Thanks for the confirmation, Glad the issue is resolved.

The problem is simply that you're not sending the function key. With AuthorizationLevel.Function, Azure expects a key in every request, and your current request doesn’t include one.

That’s why the runtime logs show:

WebJobsAuthLevel was not authenticated → no key → 401

You’re calling

YAML

string url = "https://newazureplaydistribution.azurewebsites.net/api/loginaccount";

But for AuthorizationLevel.Function, it must include the key.

Fix option 1: Add key to URL

Update your URL like this:

YAML

string url = "https://newazureplaydistribution.azurewebsites.net/api/loginaccount?code=<YOUR_FUNCTION_KEY>";

Fix option 2: Add header

Add this before sending the request:

YAML

request.Headers.Add("x-functions-key", "<YOUR_FUNCTION_KEY>");

In Azure Portal:

Go to your Function App
Click Functions =>LoginAccount function
Click "Get Function URL"
Copy the URL, it will look like:

YAML

   https://newazureplaydistribution.azurewebsites.net/api/LoginAccount?code=AbCdEf123...

code=... is your correct key.

Hope this helps!

If the resolution was helpful, kindly take a moment to click on User's image and click on Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

Hi Kim,

Based on the technical changes introduced in the April 2026 releases of the Azure Functions Worker and Identity libraries, the issue you are describing is most likely caused by one of two specific updates: the breaking change in HTTP response handling in the 2.x Worker SDK or a token acquisition failure in the new version of Azure.Identity.

Below is the validation of the versions and the steps to identify and fix the root cause.

Analysis of the Culprit Packages

The Primary Suspect: Microsoft.Azure.Functions.Worker 2.52.0
Starting with the 2.0.0 branch of the Isolated Worker SDK (which version 2.52.0 belongs to), there is a significant behavioral change in how HTTP responses are processed:
- Status Code Behavior: In version 1.x, the WriteAsJsonAsync() method automatically set the HTTP status code to 200 OK, overriding any previous value. In version 2.x, this method no longer sets the status code. If your code relies on this implicit behavior and doesn't explicitly set the status, the response might default to a state that the host interprets as 401 Unauthorized (especially if middleware or filters are present).
- Service Scope Validation: 2.x introduced stricter service provider scope validation (matching ASP.NET Core). If your function injects a scoped service that fails to resolve, it can trigger an internal failure that returns a 401 or 500 depending on your error handling.
The Secondary Suspect: Azure.Identity 1.21.0
This version updated the underlying Microsoft Authentication Library (MSAL) and changed how DefaultAzureCredential handles certain environment variables and token caching:
- Managed Identity Validation: New validation logic was added for ManagedIdentityCredential. If your environment has conflicting variables (e.g., both a User-Assigned Client ID and a System-Assigned configuration), the new version might throw a CredentialUnavailableException, which often results in a 401 if caught by a generic authentication filter.

Steps to Reproduce the Issue

To confirm which package is the culprit, follow these steps in a test environment:

Isolate the SDK: Upgrade only Microsoft.Azure.Functions.Worker and Microsoft.Azure.Functions.Worker.Sdk to the new versions while keeping Azure.Identity at 1.19.0. If the error occurs, the issue is the HTTP response handling.

Test Response Logic: Create a function using HttpResponseData and call WriteAsJsonAsync without setting response.StatusCode.

   // This may result in a non-200 status in version 2.52.0+
   var response = req.CreateResponse();
   await response.WriteAsJsonAsync(new { message = "test" });
   return response;

Isolate Identity: Revert the worker packages and upgrade only Azure.Identity to 1.21.0. Run the function in Azure (not just locally) to trigger the Managed Identity flow.

How to Fix the Issue

Fix 1: Explicitly Set Status Codes (Worker SDK Fix)

Ensure that you are explicitly setting the status code on your response objects. This is now a requirement for predictable behavior in the 2.x SDK.

var response = req.CreateResponse(HttpStatusCode.OK); // Explicitly set 200 OK
await response.WriteAsJsonAsync(data);
return response;

Fix 2: Update Application Settings (Identity Fix)

If Azure.Identity 1.21.0 is the cause, check your Azure App Service configuration. Ensure you don't have conflicting AZURE_CLIENT_ID or AZURE_TENANT_ID settings if you are intended to use the System-Assigned Managed Identity. The new library version is stricter about "non-deterministic" identity states.

Fix 3: Enable Detailed Logging

To see exactly why the 401 is occurring, add the following to your host.json to capture the worker's internal logs:

{
  "logging": {
    "logLevel": {
      "Function.YourFunctionName": "Trace",
      "Microsoft.Azure.Functions.Worker": "Debug"
    }
  }
}

Official References

Guide for running C# Azure Functions in an isolated worker process (See section on 2.x breaking changes).
Troubleshoot Azure Identity authentication issues
Azure Functions Isolated Worker GitHub Releases

Note: This response is generated with the help of AI systems.

Answer 3

I have installed exactly the same old NuGet packages that I used before and published the project to Azure and now my Azure functions work again. I don´t get the error anymore. But I don´t know which NuGet package caused the problem.

<TargetFramework>net8.0</TargetFramework>
<AzureFunctionsVersion>v4</AzureFunctionsVersion>
<OutputType>Exe</OutputType>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>annotations</Nullable>

My old NuGet packages when it works:

	<ItemGroup>
		<FrameworkReference Include="Microsoft.AspNetCore.App" />
		<PackageReference Include="Azure.Identity" Version="1.19.0" />
		<PackageReference Include="Microsoft.ApplicationInsights.WorkerService" Version="3.0.0" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker" Version="2.51.0" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker.ApplicationInsights" Version="2.50.0" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http.AspNetCore" Version="2.1.0" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="2.0.7" OutputItemType="Analyzer" />
		<PackageReference Include="PlayFabAllSDK" Version="1.220.260313" />
	</ItemGroup>

The NuGet packages when it doesn´t work:

<ItemGroup>
	<FrameworkReference Include="Microsoft.AspNetCore.App" />
	<PackageReference Include="Azure.Identity" Version="1.21.0" />
	<PackageReference Include="Microsoft.ApplicationInsights.WorkerService" Version="3.1.0" />
	<PackageReference Include="Microsoft.Azure.Functions.Worker" Version="2.52.0" />
	<PackageReference Include="Microsoft.Azure.Functions.Worker.ApplicationInsights" Version="2.50.0" />
	<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http.AspNetCore" Version="2.1.0" />
	<PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="2.0.7" OutputItemType="Analyzer" />
	<PackageReference Include="PlayFabAllSDK" Version="1.222.260410" />
</ItemGroup>

Answer 4

The HTTP 401 Unauthorized status code means the Azure Function is rejecting the request because it is not properly authenticated or the provided credentials/token are invalid.

In the provided context, 401 errors commonly occur when:

No valid authentication token or key is sent with the request.
The token or key is expired, incorrect, or does not meet the validation criteria.
The app or function is configured to require authentication and is set to return 401 for unauthenticated requests.

Relevant behaviors:

For ASP.NET Core Web APIs secured with Microsoft Entra ID, a 401 is returned when the Authorization: Bearer header is missing, the token is expired, issued for a different resource, or fails token validation rules defined in JwtBearerOptions.TokenValidationParameters.
For Azure App Service / Azure Functions with built-in authentication enabled and Require authentication configured, unauthenticated requests are rejected with HTTP 401 when the option HTTP 401 Unauthorized: recommended for APIs is selected.

Given that the code was not changed but the deployment and configuration may have been altered (new publish profile, updated packages), the error indicates that the deployed function app now requires valid authentication (for example, a function key, host key, or bearer token) and the iPad client is not sending what the function expects, or the authentication configuration in App Service/Functions is now stricter and returns 401 for anonymous calls.

References:

Share via

Azure Functions: StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.NSUrlSessionHandler+NSUrlSessionDataTaskStreamContent, Headers

3 additional answers

Analysis of the Culprit Packages

Steps to Reproduce the Issue

How to Fix the Issue

Official References

Your answer