Paul Yuknewicz paulyuk

Session: Securing Cloud Apps with Managed Identity and Networking @ NDC London 2025

Paul Yuknewicz

RAG

{
  "IsEncrypted": false,
  "Values": {
    "AzureWebJobsStorage": "UseDevelopmentStorage=true",
    "FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated",
    "AZURE_OPENAI_ENDPOINT": "https://cog-c33gk4hhzykak.openai.azure.com/",
 "CHAT_MODEL_DEPLOYMENT_NAME": "chat",

Samples for Building and Deploying Cloud Native Intelligent Apps

.NET Conf 2024

by Scott Hunter @coolcsh and Paul Yuknewicz @paulyuk

Here are all the demos shown in our session with full repos, azd templates, and a few notes. Enjoy, and let us know what you think! -- Scott and Paul

Part 1 - Aspire 9 & Functions

Configuring scale

General command to set

az functionapp scale config set --resource-group <RESOURCE_GROUP> --name <APP_NAME> --trigger-type http --trigger-settings perInstanceConcurrency=10

e.g. set to 2 events per instance

How to - Securing your Azure Function

Paul's secret mision "do this, and dont do that"

Using indentity

Using identity for AzureWebJobsStorage

Using identity for Bindings

Using identity for Deployment

Networking

Setting up vnet in your function app

Snippets for Functions Under the Hood at Scale

Configuring scale

General command to set

az functionapp scale config set --resource-group <RESOURCE_GROUP> --name <APP_NAME> --trigger-type http --trigger-settings perInstanceConcurrency=10

e.g. set to 2 events per instance

Converting a Function App to Managed Identity - 101

Overview

This shows how to take a simple Function App (e.g. the output of our client tools templates for a trigger or binding) or a simple sample and "modernize" it from using ConnectionStrings and secrets in favor of Managed Identity and RBAC.

Assumptions

User-assigned managed identity is prefered. Beware if you do not select an identity to use in code (ClientId), it will default to system assigned.
local development will make Connections to local emulators if they exist, and otherwise will make remote cloud connections to resource using identity based connections. Some resources like Service Bus, AI Cognitive, Open AI, and Datalake will

	// Project: DashcamImporter (Console Application, will be converted to Tray App)
	// Target Framework: net9.0-windows
	// NuGet Packages:
	// - Microsoft.Extensions.Hosting
	// - Microsoft.Extensions.Configuration
	// - Microsoft.Extensions.Logging
	// - System.IO.FileSystem.Watcher (Implicitly part of .NET)
	// - WindowsAPICodePack-Shell (For taskbar notifications - from NuGet)
	// - NAudio (For MP4 demuxing and audio/video handling - from NuGet)

	{
	"id": "foo",
	"customerId": "1",
	"text": "Cosmos DB is a fully managed NoSQL, relational, and vector database. It offers single-digit millisecond response times, automatic and instant scalability, along with guaranteed speed at any scale. Business continuity is assured with SLA-backed availability and enterprise-grade security.",
	"hash": "ce13da7c7cdd911e90d846b66c58ac4db6e964c8c8ff1fef1c90d6695ae7e083",
	"vectors": [
	-0.004219152,
	0.04899512,
	0.06557241,
	0.016116815,

	apiVersion: dapr.io/v1alpha1
	kind: Component
	metadata:
	name: statestore
	spec:
	type: state.redis
	version: v1
	metadata:
	# These settings will work out of the box if you use `helm install
	# bitnami/redis`. If you have your own setup, replace