Timer Trigger Not Executing on Function App with Flex Consumption Plan

@Jan Claes ,

Thanks for reaching out .
When using a user-managed identity for your Function app in the Flex Consumption plan, it's important to ensure that the identity has the necessary permissions to access both the storage account and Application Insights. If the timer trigger is not executing and there are no records in the invocation tab or Application Insights, it could indicate that the user-managed identity does not have sufficient permissions, which may prevent the function from executing as expected.

In contrast, a system-assigned identity typically has the necessary permissions automatically configured, which is why it works without issues. To resolve this, you should check the permissions granted to the user-managed identity and ensure that it has access to the required resources.

The system assigned identity and user managed identity has Storage Blob Data Owner on the storage account. The app settings on the function app:

• APPLICATIONINSIGHTS_AUTHENTICATION_STRING
• APPLICATIONINSIGHTS_CONNECTION_STRING
• AzureWebJobsStorage__blobServiceUri
• AzureWebJobsStorage__clientId: clientID of UMI
• AzureWebJobsStorage__credential: managedidentity

We configured the function app with both a system managed identity and user managed identity, if we remote the app settings:

• AzureWebJobsStorage__clientId
• APPLICATIONINSIGHTS_AUTHENTICATION_STRING

And switch to system managed identity it works. So should it be related to only permissions on the Application Insights?

After further testing and giving the UMI the Monitoring Metrics Publisher permission on the Application Insights, the trigger became active..

@Jan Claes ,

From what you've described, it looks like the issue is tied to the way the user-assigned managed identity (UMI) is being used, especially with the APPLICATIONINSIGHTS_AUTHENTICATION_STRING setting. When this is set, the Application Insights SDK tries to authenticate using that UMI.

Even though the identity has the right role on the storage account, it also needs permission to send telemetry to Application Insights. If that’s missing, the Function App host might not start properly — which can cause timer triggers not to fire and logs not to show up.

To fix this, try assigning the Monitoring Metrics Publisher role to the UMI on the Application Insights resource. In some cases, giving it the Contributor role (even temporarily) helps confirm if it’s really a permission issue.