Add role assignments to the storage account/s

Before the solution can backup your storage tables, it needs to be granted access to the storage account containing the Azure tables that you want to backup. Specifically, the system managed identity of the function app needs to be granted the Storage Table Data Reader and Storage Blob Data Contributor roles to the storage account.

The script below can do this for you. You'll need to run this against every storage account where you are backing up tables.

https://github.com/SMSAgentSoftware/AzureTableBackup/blob/main/Add-AzStorageAccountRoleAssigments.ps1

##################################################################################

## Grants the Function app identity the role assignments on the storage account ##

## required by the Azure Table Backup solution                                  ##

##################################################################################



## Check required modules

#Requires -Modules Az.Accounts,Az.Resources



$Tenant = "<tenant Id>"# The ID of the tenant containing your Azure subscription

$Subscription = "<subscription name>" # The name of the Azure subscription which hosts your resources

$StorageAccountName = "<storage account name>" # The name of the storage account containing the tables you want to backup



# Connect to Azure AD

try 

{

    $Connection = Connect-AzAccount -Subscription $Subscription -Tenant $Tenant -ErrorAction Stop

}

catch 

{

    throw $_.Exception.Message

}



# Locate the storage account resource

try 

{

    $StorageAccount = Get-AzResource `

        -Name "$StorageAccountName" `

        -ResourceType "Microsoft.Storage/storageAccounts" `

        -ErrorAction Stop

}

catch 

{

    throw $_.Exception.Message.Split([Environment]::NewLine)[0]

}

If ($null -eq $StorageAccount)

{

    throw "Storage account not found! Check the name."

}



# Locate the function app resource

try 

{

    $FunctionApp = Get-AzResource `

        -Name "func-azTableBackup*" `

        -ResourceType "Microsoft.Web/sites" `

        -ResourceGroupName "rg-azTableBackup*" `

        -ErrorAction Stop

}

catch 

{

    throw $_.Exception.Message.Split([Environment]::NewLine)[0]

}

If ($null -eq $FunctionApp)

{

    throw "Function app not found!"

}



# Add the role assignments

Write-Host "Adding role assignments for function app system identity to storage account..."

"Storage Table Data Reader","Storage Blob Data Contributor" | foreach {

    Write-Host "  $_..." -NoNewline

    try 

    {

        $RoleAssignment = New-AzRoleAssignment `

        -ObjectId $FunctionApp.Identity.PrincipalId `

        -RoleDefinitionName "$_" `

        -Scope $StorageAccount.Id `

        -WarningAction SilentlyContinue `

        -ErrorAction Stop

        Write-Host "Success!" -ForegroundColor Green

    }

    catch 

    {

        Write-Host "Failed!" -ForegroundColor Red

        Write-Warning -Message $_.Exception.Message.Split([Environment]::NewLine)[0]

    }

}

Download the script and set the parameters at the top of the script:

• Tenant (tenant Id)

• Subscription (subscription name)

• StorageAccountName (the name of the storage account containing the tables you want to backup)

Execute the script, and upon successful execution the new role assigments will be reported:

In the storage account in the Azure portal, in the Access Control (IAM) blade, in the Role assignments tab, you will see the new role assignments added.