10.3 Configure & Deploy Function Apps

Building triggers and HTTP APIs is only half of the AI-200 skill. You must also configure and deploy Function Apps so they run securely, scale under AI traffic, and ship updates without breaking production chat or document pipelines.

Function App configuration essentials

A Function App is an App Service specialization. Configuration lives primarily in Application settings (environment variables at runtime). Your code reads settings such as AZURE_OPENAI_ENDPOINT, storage connection names referenced by bindings, and feature flags.

Managed identity and Key Vault

Enable a system-assigned or user-assigned managed identity on the Function App. Grant that identity roles such as Cognitive Services OpenAI User, Storage Blob Data Reader, or Key Vault Secrets User. Then:

• Call Azure OpenAI with token credentials instead of API keys when supported.
• Store remaining secrets in Key Vault and reference them from app settings.

Exam distractors often show connection strings pasted into source files — always choose configuration + identity over hard-coding.

Hosting plans and AI latency

Why Premium matters for AI backends

Interactive AI APIs are sensitive to tail latency. On Consumption, an idle Function App may cold-start: the platform allocates a worker, loads the language worker, and then runs your code — adding seconds before the first token streams back. Premium plans keep pre-warmed instances so HTTP-triggered chat backends feel snappier. Premium also supports regional VNet integration, useful when the function must reach private Azure OpenAI, AI Search, or storage endpoints.

Choose Consumption for bursty, cost-sensitive batch workers (queue-triggered embedding jobs) where an occasional cold start is acceptable. Choose Premium (or Dedicated with Always On) when AI-200 scenarios emphasize low-latency user-facing APIs or private networking.

Deployment options

Zip deploy and Run-From-Package

Zip deploy packages your compiled functions and dependencies. With Run-From-Package, the platform mounts the zip as a read-only filesystem, which reduces file-lock issues and makes deployments atomic — a common best practice for Node and .NET publish outputs. Azure CLI and GitHub Actions templates often set WEBSITE_RUN_FROM_PACKAGE accordingly.

Deployment slots

On plans that support slots (Premium and Dedicated; not classic Consumption the same way), you deploy to a staging slot, validate HTTP health and a smoke inference call, then swap into production. Swap keeps sticky settings you mark as slot-specific (for example, a staging Azure OpenAI deployment name) while moving the code. This reduces downtime and makes rollback a reverse swap.

CI/CD checklist for AI Function Apps

1. Build and run unit tests (including binding/trigger metadata validation where applicable).
2. Deploy to a slot or test Function App.
3. Apply infrastructure settings (app settings, identity role assignments) via Bicep/Terraform — not manual portal-only drift.
4. Smoke-test: anonymous health endpoint OK; authenticated completion endpoint returns 200.
5. Swap or promote; watch Application Insights for error rate spikes.

Never commit local.settings.json secrets to git; that file is for local Core Tools only. Production uses app settings / Key Vault.

Networking, CORS, and scaling knobs

• CORS: Allow specific SPA origins on the Function App or terminate CORS at API Management.
• Scale out: Consumption and Premium scale out based on trigger load (HTTP concurrency, queue length). Understand that each instance may open connections to Azure OpenAI — watch service throttling (429) and use retries with backoff.
• Runtime version: Pin a supported Functions runtime major version; upgrades can change extension bundles.
• Extension bundles: Non-.NET languages often rely on extension bundles for binding support — keep them current in host.json guidance from Microsoft docs.

host.json vs app settings

For AI workers, host.json might tune queue batch size so document jobs process efficiently without overwhelming the model endpoint. App settings still hold the endpoint URL and deployment name.

Monitoring after deploy

Connect Application Insights during Function App creation or afterward. Use live metrics during a slot swap. Set alerts on failed function executions and dependency failures to Azure OpenAI. Log Analytics queries help prove whether latency is cold start, model time, or downstream storage.

End-to-end production picture

1. Create Function App on Premium if the AI API is user-facing and latency-sensitive; use Consumption for async queue workers if cost dominates.
2. Enable managed identity; grant access to Storage, Key Vault, and Azure AI resources.
3. Configure app settings and Key Vault references; set FUNCTIONS_WORKER_RUNTIME.
4. Deploy via CI zip deploy / Run-From-Package into a slot, smoke-test, swap.
5. Monitor with Application Insights; tune scale and plan if cold starts or throttling appear.

Key Takeaways

• App settings + Key Vault references + managed identity are the secure configuration pattern.
• Consumption scales to zero but can cold-start; Premium reduces latency for AI HTTP APIs and adds VNet options.
• Zip deploy, Run-From-Package, CI/CD, and deployment slots are the main deployment tools.
• Keep secrets out of source; use slots for safer releases; monitor with Application Insights.