Add role assignments to the storage account/s

Before the solution can backup your storage tables, it needs to be granted access to the storage account containing the Azure tables that you want to backup. Specifically, the system managed identity of the function app needs to be granted the Storage Table Data Reader and Storage Blob Data Contributor roles to the storage account.

The script below can do this for you. You'll need to run this against every storage account where you are backing up tables.

https://github.com/SMSAgentSoftware/AzureTableBackup/blob/main/Add-AzStorageAccountRoleAssigments.ps1

##################################################################################
## Grants the Function app identity the role assignments on the storage account ##
## required by the Azure Table Backup solution                                  ##
##################################################################################

## Check required modules
#Requires -Modules Az.Accounts,Az.Resources

$Tenant = "<tenantId>"# The ID of the tenant containing your Azure subscription
$Subscription = "<subscriptionName>" # The name of the Azure subscription which hosts your resources
$StorageAccountName = "<storageAccountName" # The name of the storage account containing the tables you want to backup

# Connect to Azure AD
try 
{
    $Connection = Connect-AzAccount -Subscription $Subscription -Tenant $Tenant -ErrorAction Stop
}
catch 
{
    throw $_.Exception.Message
}

# Locate the storage account resource
try 
{
    $StorageAccount = Get-AzResource `
        -Name "$StorageAccountName" `
        -ResourceType "Microsoft.Storage/storageAccounts" `
        -ErrorAction Stop
}
catch 
{
    throw $_.Exception.Message.Split([Environment]::NewLine)[0]
}
If ($null -eq $StorageAccount)
{
    throw "Storage account not found! Check the name."
}

# Locate the function app resource
try 
{
    $FunctionApp = Get-AzResource `
        -Name "func-azTableBackup*" `
        -ResourceType "Microsoft.Web/sites" `
        -ResourceGroupName "rg-azTableBackup*" `
        -ErrorAction Stop
}
catch 
{
    throw $_.Exception.Message.Split([Environment]::NewLine)[0]
}
If ($null -eq $FunctionApp)
{
    throw "Function app not found!"
}

# Add the role assignments
Write-Host "Adding role assignments for function app system identity to storage account..."
"Storage Table Data Reader","Storage Blob Data Contributor" | foreach {
    Write-Host "  $_..." -NoNewline
    try 
    {
        $RoleAssignment = New-AzRoleAssignment `
        -ObjectId $FunctionApp.Identity.PrincipalId `
        -RoleDefinitionName "$_" `
        -Scope $StorageAccount.Id `
        -WarningAction SilentlyContinue `
        -ErrorAction Stop
        Write-Host "Success!" -ForegroundColor Green
    }
    catch 
    {
        Write-Host "Failed!" -ForegroundColor Red
        Write-Warning -Message $_.Exception.Message.Split([Environment]::NewLine)[0]
    }
}

Download the script and set the parameters at the top of the script:

• Tenant (tenant Id)

• Subscription (subscription name)

• StorageAccountName (the name of the storage account containing the tables you want to backup)

Execute the script, and upon successful execution the new role assigments will be reported:

In the storage account in the Azure portal, in the Access Control (IAM) blade, in the Role assignments tab, you will see the new role assignments added.