az functionapp deployment source config-zip fails when storage account networking is restricted to VNET

[mibowers]

Describe the bug

Deploying an Azure Function from a ZIP file through Az CLI from self-hosted agent set up on Azure VM works when the Storage Account has networking set to "Enable from all networks", but it fails when the Storage Account has networking set to "Enabled from selected virtual networks and IP addresses" with Azure Function and Storage Account resources on a whitelisted VNET. The authenticated user performing the command has Contributor role on all of the resources involved.

Related command

az functionapp deployment source config-zip -g rg-name -n func-name --src filename.zip

Errors

Getting scm site credentials for zip deployment Starting zip deployment. This operation can take a while to complete ... Deployment endpoint responded with status code 500 An error occured during deployment. Status Code: 500, Details: {"Message":"An error has occurred.","ExceptionMessage":"An error occurred when trying to create a controller of type 'PushDeploymentController'. Make sure that the controller has a parameterless public constructor.","ExceptionType":"System.InvalidOperationException","StackTrace":" at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.Create(HttpRequestMessage request, HttpControllerDescriptor controllerDescriptor, Type controllerType)\r\n at System.Web.Http.Controllers.HttpControllerDescriptor.CreateController(HttpRequestMessage request)\r\n at System.Web.Http.Dispatcher.HttpControllerDispatcher.d__1.MoveNext()","InnerException":{"Message":"An error has occurred.","ExceptionMessage":"Access to the path 'C:\home\LogFiles\kudu\deployment' is denied.","ExceptionType":"System.UnauthorizedAccessException","StackTrace":" at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)\r\n at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)\r\n at System.IO.Abstractions.DirectoryWrapper.CreateDirectory(String path)\r\n at Kudu.Core.Environment.get_DeploymentTracePath()\r\n at Kudu.Services.Web.App_Start.NinjectServices.GetLogger(IEnvironment environment, IKernel kernel) in C:\__w\1\s\Kudu.Services.Web\App_Start\NinjectServices.cs:line 805\r\n at Ninject.Activation.Provider1.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at Ninject.ResolutionExtensions.TryGet[T](IEnumerable1 iterator)\r\n at Kudu.Services.Web.Services.NinjectDependencyScope.GetService(Type serviceType) in C:\__w\1\s\Kudu.Services.Web\Services\NinjectWebApiDependencyResolver.cs:line 45\r\n at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.GetInstanceOrActivator(HttpRequestMessage request, Type controllerType, Func`1& activator)\r\n at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.Create(HttpRequestMessage request, HttpControllerDescriptor controllerDescriptor, Type controllerType)"}}

Issue script & Debug output

cli.azure.cli.command_modules.appservice.custom: Starting zip deployment. This operation can take a while to complete ...
urllib3.connectionpool: Starting new HTTPS connection (1): redacted.scm.azurewebsites.net:443
urllib3.connectionpool: https://redacted.scm.azurewebsites.net:443 "POST /api/zipdeploy?isAsync=true&Deployer=az_cli_functions HTTP/1.1" 500 4005
cli.azure.cli.command_modules.appservice.custom: Deployment endpoint responded with status code 500
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 666, in execute
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 734, in _run_jobs_serially
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 703, in _run_job
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 336, in call
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 120, in handler
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/appservice/custom.py", line 690, in enable_zip_deploy_functionapp
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/appservice/custom.py", line 861, in enable_zip_deploy
azure.cli.core.azclierror.AzureInternalError: An error occured during deployment. Status Code: 500, Details: {"Message":"An error has occurred.","ExceptionMessage":"An error occurred when trying to create a controller of type 'PushDeploymentController'. Make sure that the controller has a parameterless public constructor.","ExceptionType":"System.InvalidOperationException","StackTrace":" at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.Create(HttpRequestMessage request, HttpControllerDescriptor controllerDescriptor, Type controllerType)\r\n at System.Web.Http.Controllers.HttpControllerDescriptor.CreateController(HttpRequestMessage request)\r\n at System.Web.Http.Dispatcher.HttpControllerDispatcher.d__1.MoveNext()","InnerException":{"Message":"An error has occurred.","ExceptionMessage":"Access to the path 'C:\home\LogFiles\kudu\deployment' is denied.","ExceptionType":"System.UnauthorizedAccessException","StackTrace":" at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)\r\n at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)\r\n at System.IO.Abstractions.DirectoryWrapper.CreateDirectory(String path)\r\n at Kudu.Core.Environment.get_DeploymentTracePath()\r\n at Kudu.Services.Web.App_Start.NinjectServices.GetLogger(IEnvironment environment, IKernel kernel) in C:\__w\1\s\Kudu.Services.Web\App_Start\NinjectServices.cs:line 805\r\n at Ninject.Activation.Provider1.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at Ninject.ResolutionExtensions.TryGet[T](IEnumerable1 iterator)\r\n at Kudu.Services.Web.Services.NinjectDependencyScope.GetService(Type serviceType) in C:\__w\1\s\Kudu.Services.Web\Services\NinjectWebApiDependencyResolver.cs:line 45\r\n at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.GetInstanceOrActivator(HttpRequestMessage request, Type controllerType, Func`1& activator)\r\n at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.Create(HttpRequestMessage request, HttpControllerDescriptor controllerDescriptor, Type controllerType)"}}

cli.azure.cli.core.azclierror: An error occured during deployment. Status Code: 500, Details: {"Message":"An error has occurred.","ExceptionMessage":"An error occurred when trying to create a controller of type 'PushDeploymentController'. Make sure that the controller has a parameterless public constructor.","ExceptionType":"System.InvalidOperationException","StackTrace":" at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.Create(HttpRequestMessage request, HttpControllerDescriptor controllerDescriptor, Type controllerType)\r\n at System.Web.Http.Controllers.HttpControllerDescriptor.CreateController(HttpRequestMessage request)\r\n at System.Web.Http.Dispatcher.HttpControllerDispatcher.d__1.MoveNext()","InnerException":{"Message":"An error has occurred.","ExceptionMessage":"Access to the path 'C:\home\LogFiles\kudu\deployment' is denied.","ExceptionType":"System.UnauthorizedAccessException","StackTrace":" at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)\r\n at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)\r\n at System.IO.Abstractions.DirectoryWrapper.CreateDirectory(String path)\r\n at Kudu.Core.Environment.get_DeploymentTracePath()\r\n at Kudu.Services.Web.App_Start.NinjectServices.GetLogger(IEnvironment environment, IKernel kernel) in C:\__w\1\s\Kudu.Services.Web\App_Start\NinjectServices.cs:line 805\r\n at Ninject.Activation.Provider1.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at Ninject.ResolutionExtensions.TryGet[T](IEnumerable1 iterator)\r\n at Kudu.Services.Web.Services.NinjectDependencyScope.GetService(Type serviceType) in C:\__w\1\s\Kudu.Services.Web\Services\NinjectWebApiDependencyResolver.cs:line 45\r\n at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.GetInstanceOrActivator(HttpRequestMessage request, Type controllerType, Func1& activator)\r\n at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.Create(HttpRequestMessage request, HttpControllerDescriptor controllerDescriptor, Type controllerType)"}} az_command_data_logger: An error occured during deployment. Status Code: 500, Details: {"Message":"An error has occurred.","ExceptionMessage":"An error occurred when trying to create a controller of type 'PushDeploymentController'. Make sure that the controller has a parameterless public constructor.","ExceptionType":"System.InvalidOperationException","StackTrace":" at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.Create(HttpRequestMessage request, HttpControllerDescriptor controllerDescriptor, Type controllerType)\r\n at System.Web.Http.Controllers.HttpControllerDescriptor.CreateController(HttpRequestMessage request)\r\n at System.Web.Http.Dispatcher.HttpControllerDispatcher.<SendAsync>d__1.MoveNext()","InnerException":{"Message":"An error has occurred.","ExceptionMessage":"Access to the path 'C:\\home\\LogFiles\\kudu\\deployment' is denied.","ExceptionType":"System.UnauthorizedAccessException","StackTrace":" at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)\r\n at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)\r\n at System.IO.Abstractions.DirectoryWrapper.CreateDirectory(String path)\r\n at Kudu.Core.Environment.get_DeploymentTracePath()\r\n at Kudu.Services.Web.App_Start.NinjectServices.GetLogger(IEnvironment environment, IKernel kernel) in C:\\__w\\1\\s\\Kudu.Services.Web\\App_Start\\NinjectServices.cs:line 805\r\n at Ninject.Activation.Provider1.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at System.Linq.Enumerable.WhereSelectArrayIterator2.MoveNext()\r\n at System.Linq.Buffer1..ctor(IEnumerable1 source)\r\n at System.Linq.Enumerable.ToArray[TSource](IEnumerable1 source)\r\n at Ninject.Activation.Providers.StandardProvider.Create(IContext context)\r\n at Ninject.Activation.Context.ResolveInternal(Object scope)\r\n at Ninject.Activation.Context.Resolve()\r\n at System.Linq.Enumerable.WhereSelectEnumerableIterator2.MoveNext()\r\n at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable1 source)\r\n at Ninject.ResolutionExtensions.TryGet[T](IEnumerable1 iterator)\r\n at Kudu.Services.Web.Services.NinjectDependencyScope.GetService(Type serviceType) in C:\\__w\\1\\s\\Kudu.Services.Web\\Services\\NinjectWebApiDependencyResolver.cs:line 45\r\n at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.GetInstanceOrActivator(HttpRequestMessage request, Type controllerType, Func1& activator)\r\n at System.Web.Http.Dispatcher.DefaultHttpControllerActivator.Create(HttpRequestMessage request, HttpControllerDescriptor controllerDescriptor, Type controllerType)"}}
cli.knack.cli: Event: Cli.PostExecute []
az_command_data_logger: exit code: 1

Expected behavior

Azure Function packaged as a ZIP file should be successfully deployed to the Azure Function resource.

Environment Summary

azure-cli 2.74.0

core 2.74.0
telemetry 1.1.0

Dependencies:
msal 1.32.3
azure-mgmt-resource 23.3.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\redacted.azure'
Extensions directory 'C:\Users\redacted.azure\cliextensions'

Python (Windows) 3.12.10 (tags/v3.12.10:0cc8128, Apr 8 2025, 12:21:36) [MSC v.1943 64 bit (AMD64)]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

No response

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @AnatoliB, @Francisco-Gamino, @shreyabatra4.

[yonzhan]

route to functions team

[mibowers]

This has been resolved. It turned out that you need to use "WEBSITE_CONTENTOVERVNET" environment setting with value of 1 even though the Azure Function docs say it's a legacy setting and has been replaced by "vnetContentShareEnabled".