CC: Paul Yuknewicz (@paulyuk) 👀
Check for a solution in the Azure portal
N/A - this is a provisioning/validation defect observed when creating a Flex Consumption function app via IaC.
Investigative information
- Timestamp: 2026-08-03 (UTC)
- Function App version: Flex Consumption (Linux,
dotnet-isolated, runtime 10.0)
- Region: westus
- Reproduction is IaC-driven (Terraform azurerm), not runtime-invocation related, so no Invocation ID applies.
Repro steps
- Create a Flex Consumption function app (Linux,
dotnet-isolated) with app settings whose names contain :, e.g.:
MongoDb:ConnectionString=...ServiceBus:ConnectionString=...AzureOpenAI:DeploymentName=...
- Create/update the app (Terraform
azurerm_function_app_flex_consumption, ARM, or portal).
Expected behavior
The error should name the offending setting and explain the rule. The Functions app-settings docs say both : and __ are reserved delimiters in setting names, and only __ is supported cross-platform. So ServiceBus:ConnectionString should be rejected with a message that identifies that key and points at the __ convention.
Actual behavior
The create/update is rejected with 400 BadRequest, but the first error reported does not name the offending setting. Observed messages:
"The following app setting (Site.SiteConfig.AppSettings.FUNCTIONS_WORKER_RUNTIME) for Flex Consumption sites is invalid. Please remove or rename it before retrying." — misleading, since FUNCTIONS_WORKER_RUNTIME was not set as a user app setting at all (Flex derives it from the runtime config).- Only after removing the misleading red herring does the real error surface:
"AppSetting with name ServiceBus:ConnectionString is not allowed."
Because Azure appears to validate the settings batch and report a single error, a genuinely invalid :-named key is masked by an unrelated FUNCTIONS_WORKER_RUNTIME message, sending users down the wrong debugging path.
Known workarounds
Use double-underscore separators (ServiceBus__ConnectionString, AzureOpenAI__DeploymentName). The .NET configuration provider maps __ to : at runtime, so code reads config["ServiceBus:ConnectionString"] unchanged. This is documented under "App setting considerations" in the app-settings reference.
Related
Suggested improvement
Report all invalid setting names in the batch (or at least surface :-containing keys explicitly, e.g. "app setting name \u2018X\u2019 contains a reserved character \u2018:\u2019; use \u2018__\u2019 instead").
CC: Paul Yuknewicz (@paulyuk) 👀
Check for a solution in the Azure portal
N/A - this is a provisioning/validation defect observed when creating a Flex Consumption function app via IaC.
Investigative information
dotnet-isolated, runtime 10.0)Repro steps
dotnet-isolated) with app settings whose names contain:, e.g.:MongoDb:ConnectionString=...ServiceBus:ConnectionString=...AzureOpenAI:DeploymentName=...azurerm_function_app_flex_consumption, ARM, or portal).Expected behavior
The error should name the offending setting and explain the rule. The Functions app-settings docs say both
:and__are reserved delimiters in setting names, and only__is supported cross-platform. SoServiceBus:ConnectionStringshould be rejected with a message that identifies that key and points at the__convention.Actual behavior
The create/update is rejected with
400 BadRequest, but the first error reported does not name the offending setting. Observed messages:"The following app setting (Site.SiteConfig.AppSettings.FUNCTIONS_WORKER_RUNTIME) for Flex Consumption sites is invalid. Please remove or rename it before retrying."— misleading, sinceFUNCTIONS_WORKER_RUNTIMEwas not set as a user app setting at all (Flex derives it from the runtime config)."AppSetting with name ServiceBus:ConnectionString is not allowed."Because Azure appears to validate the settings batch and report a single error, a genuinely invalid
:-named key is masked by an unrelatedFUNCTIONS_WORKER_RUNTIMEmessage, sending users down the wrong debugging path.Known workarounds
Use double-underscore separators (
ServiceBus__ConnectionString,AzureOpenAI__DeploymentName). The .NET configuration provider maps__to:at runtime, so code readsconfig["ServiceBus:ConnectionString"]unchanged. This is documented under "App setting considerations" in the app-settings reference.Related
Suggested improvement
Report all invalid setting names in the batch (or at least surface
:-containing keys explicitly, e.g. "app setting name \u2018X\u2019 contains a reserved character \u2018:\u2019; use \u2018__\u2019 instead").