How to authenticate Azure Batch from Python Function App using Managed Identity?

If you're trying to call Azure Batch APIs from a Python-based Azure Function App using Managed Identity, you’ll need a Storage Account, an Azure Batch Account, Linux Consumption/EPM Function App (Python 3.10+) and a System-assigned Managed Identity

Example-

# Set storage name and create storage account

$storageName = "arkstorage$((Get-Random -Maximum 99999))"

az storage account create `

  --name $storageName `

  --resource-group arkorg `

  --location centralindia `

  --sku Standard_LRS

# Create Azure Batch account linked to the storage account

az batch account create `

  --name arkbatchaccount `

  --resource-group arkorg `

  --location centralindia `

  --storage-account $storageName

# Create Premium Elastic App Plan (for Linux Functions)

az functionapp plan create `

  --resource-group arkorg `

  --name arkfuncplan `

  --location centralindia `

  --number-of-workers 1 `

  --sku EP1 `

  --is-linux

# Create Function App with System-assigned Managed Identity

az functionapp create `

  --resource-group arkorg `

  --plan arkfuncplan `

  --name arkbatchfuncapp `

  --runtime python `

  --runtime-version 3.10 `

  --functions-version 4 `

  --os-type Linux `

  --storage-account $storageName `

  --assign-identity

Assign Permissions to the Function App

# Get the principal ID of the function's managed identity

$principalId = az functionapp identity show `

  --resource-group arkorg `

  --name arkbatchfuncapp `

  --query principalId `

  -o tsv

# Get the Batch account scope

$batchScope = az batch account show `

  --name arkbatchaccount `

  --resource-group arkorg `

  --query id `

  -o tsv

# Assign "Contributor" role (minimum needed for most Batch operations)

az role assignment create `

  --assignee $principalId `

  --role "Contributor" `

  --scope $batchScope

Create Function App Project with Batch SDK

func init arkbatchfunc --worker-runtime python

cd arkbatchfunc

func new --template "HTTP trigger" --name BatchTrigger

Update requirements.txt

azure-functions

azure-identity

azure-batch

msrest

Install pip install -r requirements.txt

Write Python Function Code to Authenticate via Managed Identity

Inside BatchTrigger/function_app.py (or init.py)

import logging

import azure.functions as func

from azure.identity import DefaultAzureCredential

from azure.batch import BatchServiceClient

from azure.batch.models import BatchErrorException

def main(req: func.HttpRequest) -> func.HttpResponse:

    try:

        credential = DefaultAzureCredential()

        batch_url = "https://arkbatchaccount.centralindia.batch.azure.com"

        batch_client = BatchServiceClient(

            credential=credential,

            batch_url=batch_url

        )

        # Example: List pools

        pool_list = list(batch_client.pool.list())

        pool_ids = [p.id for p in pool_list]

        return func.HttpResponse(f"Connected! Pools: {pool_ids}", status_code=200)

    except BatchErrorException as be:

        logging.error(f"Batch error: {be}")

        return func.HttpResponse("Batch error occurred", status_code=500)

    except Exception as e:

        logging.error(f"General error: {e}")

        return func.HttpResponse("Unhandled error occurred", status_code=500)

Deploy to Azure and Get Function URL

func azure functionapp publish arkbatchfuncapp

az functionapp function show `

  --resource-group arkorg `

  --name arkbatchfuncapp `

  --function-name BatchTrigger `

  --query "invokeUrlTemplate" `

  -o tsv

Get function key

az functionapp function keys list `

  --resource-group arkorg `

  --name arkbatchfuncapp `

  --function-name BatchTrigger `

  --query "default" `

  -o tsv

Test it via your url in my case-

https://arkbatchfuncapp.azurewebsites.net/api/batch?code=<your-function-key>

This setup uses Azure Managed Identity and Azure Identity SDK (no hardcoded credentials) to securely authenticate your Function App with Azure Batch