Step 0: Install Azure CLI

Before managing Azure IAM or Functions, install the Azure CLI:

# Windows: MSI installer
https://aka.ms/installazurecliwindows

# macOS: Homebrew
brew update && brew install azure-cli

# Linux: Run this script
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# Login
az login

# Set default subscription (if you have multiple)
az account set --subscription "SUBSCRIPTION_ID"

Create a Function App

Go to Azure Portal > Create a Resource > Compute > Function App

• Runtime stack: Python
• Region: Closest to your users
• Hosting plan: Consumption (pay-per-use)

Choose the Trigger Type: HTTP

Add an HTTP-triggered function and write the code as before.

import azure.functions as func
import json

def main(req: func.HttpRequest) -> func.HttpResponse:
    name = req.params.get('name')
    if not name:
        try:
            req_body = req.get_json()
        except ValueError:
            pass
        else:
            name = req_body.get('name')

    if name:
        return func.HttpResponse(f"Hello, {name}!")
    else:
        return func.HttpResponse("Please pass a name on the query string or in the request body", status_code=400)

Step 1: Understanding Azure IAM (Role-Based Access Control)

Azure IAM allows you to control who can access your resources and what they can do. You assign roles to users, groups, and service principals.

• Built-in Roles: Owner, Contributor, Reader, and many service-specific roles.
• Custom Roles: Create your own role with precise permissions.
• Scope: Assign roles at subscription, resource group, or individual resource level.

Step 2: IAM Scenario

Imagine a project with three teams:

• Dev Team – deploys Functions
• Ops Team – manages resources like Storage & Networking
• Audit Team – reviews logs and monitors security

We can assign roles as follows:

# Assign Contributor role to Dev Team
az role assignment create \
  --assignee [email protected] \
  --role "Contributor" \
  --scope /subscriptions/SUBSCRIPTION_ID/resourceGroups/MY_RESOURCE_GROUP

# Assign Owner role to Ops Team
az role assignment create \
  --assignee [email protected] \
  --role "Owner" \
  --scope /subscriptions/SUBSCRIPTION_ID/resourceGroups/MY_RESOURCE_GROUP

# Assign Reader role to Audit Team
az role assignment create \
  --assignee [email protected] \
  --role "Reader" \
  --scope /subscriptions/SUBSCRIPTION_ID

Step 3: Service Principals

Use service principals for apps or automation to access resources securely:

# Create a service principal
az ad sp create-for-rbac --name "my-app-sp" --role Contributor --scopes /subscriptions/SUBSCRIPTION_ID/resourceGroups/MY_RESOURCE_GROUP

# Output contains appId, password, and tenant for authentication in your code

Step 4: View IAM Assignments

# List role assignments for a resource group
az role assignment list --scope /subscriptions/SUBSCRIPTION_ID/resourceGroups/MY_RESOURCE_GROUP --output table

Step 5: Best Practices

• Follow principle of least privilege: assign only needed roles.
• Use groups for team-based permissions.
• Audit role assignments periodically.
• Use service principals for automation, never user accounts.