[App Service] az functionapp create, az functionapp deployment config set: Add Flex Consumption Registry deployment storage support

[pragatikushwaha]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Tests
⚠️ None	️✔️ 130/130

⚠️AzureCLI-BreakingChangeTest

⚠️appservice

rule	cmd_name	rule_message	suggest_message
⚠️ 1006 - ParaAdd	functionapp create	cmd functionapp create added parameter deployment_image_auth_type
⚠️ 1006 - ParaAdd	functionapp create	cmd functionapp create added parameter deployment_image_identity
⚠️ 1006 - ParaAdd	functionapp create	cmd functionapp create added parameter deployment_image_password_setting
⚠️ 1006 - ParaAdd	functionapp create	cmd functionapp create added parameter deployment_image_username_setting
⚠️ 1006 - ParaAdd	functionapp create	cmd functionapp create added parameter deployment_image
⚠️ 1006 - ParaAdd	functionapp deployment config set	cmd functionapp deployment config set added parameter deployment_image_auth_type
⚠️ 1006 - ParaAdd	functionapp deployment config set	cmd functionapp deployment config set added parameter deployment_image_identity
⚠️ 1006 - ParaAdd	functionapp deployment config set	cmd functionapp deployment config set added parameter deployment_image_password_setting
⚠️ 1006 - ParaAdd	functionapp deployment config set	cmd functionapp deployment config set added parameter deployment_image_username_setting
⚠️ 1006 - ParaAdd	functionapp deployment config set	cmd functionapp deployment config set added parameter deployment_image

Related command
az functionapp create
az functionapp deployment config set
az functionapp deployment config show
az functionapp show

Description
Flex Consumption apps can run a container image by setting functionAppConfig.deployment.storage.type to Registry (Microsoft.Web API version 2025-05-01). This PR adds CLI support for configuring it.

New arguments, in a Flex Registry Deployment argument group on az functionapp create and az functionapp deployment config set:

Argument	Alias	Notes
--deployment-image		Image reference (tag, digest, or tag and digest). Sent unchanged.
--deployment-image-auth-type	--diat	Anonymous, SystemAssignedIdentity, UserAssignedIdentity, or Basic.
--deployment-image-identity	--dii	User-assigned identity resource ID. UserAssignedIdentity only.
--deployment-image-username-setting	--dius	Name of the app setting that stores the registry username. Basic only.
--deployment-image-password-setting	--dips	Name of the app setting that stores the registry password. Basic only.

Behavior:

• Each authentication mode sends exactly its own fields. Arguments that don't apply to the selected mode are rejected before any request is sent. Basic takes username and password app-setting names; the CLI never accepts a registry password and never reads app settings.
• As requested in review, neither create nor config set accepts --deployment-image-server-url/--diurl. A newly constructed Basic authentication object contains only type, usernameSettingName, and passwordSettingName (no serverUrl). A site that already has a service-set serverUrl may still show it and preserve it when authentication is not replaced; explicitly replacing authentication writes only the supplied mode's fields. This narrows the CLI from the current ADO task/GitHub Add missing pyyaml dependency in setup.py #86/Provide TSV (tab separated values) output formatter  #88 optional-field criterion, without changing the Microsoft.Web API schema; owner confirmation and task-criterion alignment are pending.
• The CLI requires a non-empty image but doesn't parse or validate OCI syntax. Service validation errors are surfaced as returned.
• az functionapp create --deployment-image ... builds a Registry functionAppConfig without a runtime and explicitly sends siteUpdateStrategy.type = Recreate, matching the service default. --runtime, --runtime-version, --environment, --deployment-storage-*, and the legacy --registry-* arguments are rejected. --maximum-instance-count defaults to 1000 for Registry creates (per review request, with owner sign-off still needed), and --instance-memory defaults to 2048 MB; existing Blob create defaults are unchanged. --always-ready-instances is supported, and Application Insights is created unless --disable-app-insights is set. Registry image configuration does not automatically assign identities or grant registry access; use --assign-identity, --role AcrPull, and --scope for that.
• az functionapp deployment config set --deployment-image ... reads the site at 2025-05-01, updates only deployment.storage, removes functionAppConfig.runtime, and writes the site back with a single PUT at 2025-05-01, so other properties are preserved. Switching from blob storage requires both the image and the authentication type; on an app that already uses Registry storage, either can be updated alone only when the retained counterpart is non-empty. The merged configuration must contain a non-empty image and authentication type before any PUT; supplying valid values can repair missing stored configuration. Blob and Registry arguments can't be combined, and blob arguments are rejected on Registry apps.
• az functionapp show and az functionapp deployment config show use their existing raw 2023-12-01 reads, without a Registry-specific second GET. The full returned JSON preserves Registry authentication and unknown fields without older-schema projection. show_functionapp matches the baseline implementation exactly; non-Flex apps and slots retain their existing SDK/configuration/publishing-information path. Credential values are never retrieved; Basic shows only the app setting names.
• Existing Flex scale, always-ready, and update-strategy writes also preserve Registry authentication: they use the existing raw 2023-12-01 GET, remove response-only null fields/runtime for Registry, and PUT Registry configuration at 2025-05-01. Blob apps keep their original GET/PUT requests at 2023-12-01. az functionapp runtime config set rejects Registry apps because they have no runtime. The explicit newer API remains on new Registry deployment writes to honor the published contract; redundant read/identity version switching has been removed.
• Registry az functionapp identity assign and az functionapp identity remove use normal SDK API selection, without Registry-specific GET/PUT overrides, and preserve Basic authentication setting names and unknown configuration. The unused runtime and other modes' null fields are still omitted in the identity PUT. Real-SDK transport tests cover default-version requests for Registry Basic, Blob, and non-Flex apps; Blob and non-Flex requests remain unchanged.
• Existing blob storage behavior and legacy Linux container settings (az functionapp config container) are unchanged.

Testing Guide

# Create a Flex Consumption app that pulls from Azure Container Registry with its system-assigned identity
az functionapp create -g MyResourceGroup -n MyApp -s MyStorageAccount --flexconsumption-location eastus \
    --deployment-image myregistry.azurecr.io/myimage@sha256:<digest> --deployment-image-auth-type SystemAssignedIdentity \
    --assign-identity [system] --role AcrPull --scope <acr-resource-id>

# Switch an existing Flex Consumption app to a container image pulled with a user-assigned identity
az functionapp deployment config set -g MyResourceGroup -n MyApp --deployment-image myregistry.azurecr.io/myimage:v1 \
    --deployment-image-auth-type UserAssignedIdentity --deployment-image-identity <identity-resource-id>

# On the existing Registry app, change only the authentication to Basic, with the credentials stored in app settings
az functionapp deployment config set -g MyResourceGroup -n MyApp --deployment-image-auth-type Basic \
    --deployment-image-username-setting REGISTRY_USERNAME --deployment-image-password-setting REGISTRY_PASSWORD

# A subsequent scale update preserves the Registry Basic authentication references
az functionapp scale config set -g MyResourceGroup -n MyApp --maximum-instance-count 50
az functionapp deployment config show -g MyResourceGroup -n MyApp
az functionapp show -g MyResourceGroup -n MyApp --query properties.functionAppConfig

Tests:

• test_functionapp_commands_thru_mock.py: TestFlexRegistryDeploymentConfigMocked, TestFlexRegistryIdentityMocked, TestFlexRegistryCreateMocked, and TestFlexRegistryArgumentParsing cover exact request payloads and API versions for every authentication mode and image form, set/show round-trips through both show commands (blob requests unchanged), partial updates, missing/null/empty merged image/authentication rejection without writing, repair of invalid stored configuration, non-Flex app/slot routing, rejection of invalid arguments without writing, a service rejection followed by a show that returns the previous configuration, absence of secrets in debug logs and in set/show output, preservation of Registry authentication across scale/always-ready/update-strategy and real-SDK identity assign/remove writes with Blob HTTP requests unchanged, runtime-set rejection, create conflicts and defaults, legacy container markers never set on create (container kind, linuxFxVersion, DOCKER_* settings), and argument aliases, including rejection of both removed server URL flags.
• test_functionapp_commands.py: live scenario test_functionapp_flex_registry_deployment (FunctionAppFlex is a LiveScenarioTest) covers create, both show commands, identity and Basic updates, digest and tag-plus-digest images, and a rejected update followed by show.

Review and rollout

• Owner sign-off is needed for argument names/aliases, the Registry-only 1000 scale default (1000 is a documented scale-out ceiling, while the existing Blob default is 100), default Application Insights behavior, and this CLI-only omission of the optional service serverUrl. The complete mocked command test file passes against the actual CLI 2.91 source (68 tests, 58 subtests); full App Service pylint/PEP8 and the command/help linter with CI exclusions pass. Changed Python compilation, help YAML parsing, baseline show-implementation comparison, and whitespace checks also pass. Full remote CI and live Registry E2E are separate release gates. On this head, the repo-wide style jobs fail on the same pre-existing ACS, SQL, and CLI-core diagnostics seen on the prior head, with no App Service style diagnostics; live E2E has not run on this head and requires a Registry-enabled region and the published 2025-05-01 contract.
• Preservation is validated for this CLI and its current SDK models; other CLI/SDK versions and other full-site writers require separate compatibility validation. No migration, new dependency, feature flag, or telemetry is introduced; rollback is a revert commit. The current task contract accepts explicit tag-only, digest-only, and tag-plus-digest references; the CLI transmits them unchanged for service validation.

History Notes
[App Service] az functionapp create: Add --deployment-image and related arguments to create Flex Consumption apps that run a container image
[App Service] az functionapp deployment config set: Add --deployment-image and related arguments to configure container image deployment for Flex Consumption apps
[App Service] az functionapp show, az functionapp deployment config show: Return the container image deployment configuration of Flex Consumption apps
[App Service] az functionapp scale config set, az functionapp scale config always-ready set, az functionapp scale config always-ready delete, az functionapp update-strategy config set: Preserve Registry authentication in Flex configuration updates
[App Service] az functionapp identity assign, az functionapp identity remove: Preserve Registry authentication through identity changes
[App Service] az functionapp runtime config set: Explain that Registry-based Flex apps have no runtime to update

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Copilot]

Copilot review overview

🟡 Changes recommended

A post-create identity update can erase Basic Registry authentication fields by rewriting the site through an older API.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Preserve Basic Registry credentials during identity assignment · New
• Add deployment images to Registry authentication examples · New

What changed in this PR

Adds Flex Consumption Registry deployment storage support to App Service commands.

Changes:

• Adds Registry image/authentication arguments and validation.
• Uses API 2025-05-01 while preserving Registry configuration.
• Adds help, mocked tests, and a live scenario.

File	Description
utils.py	Supports explicit API versions for raw reads.
custom.py	Implements Registry create, update, show, and preservation logic.
_params.py	Registers Registry deployment arguments.
_help.py	Documents Registry workflows and examples.
_constants.py	Defines auth modes, API version, and defaults.
test_functionapp_commands.py	Adds live Registry coverage.
test_functionapp_commands_thru_mock.py	Adds request, validation, and preservation tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Aditya Pujara (a0x1ab)]

/azp run

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[pragatikushwaha]

North Central US Stage validation

I tested this PR against North Central US (Stage) using a non-production test subscription. The full report below is a public-safe version of the live validation record; subscription/resource identifiers and internal telemetry details were removed.

View the full sanitized North Central US Stage validation report

Flex Consumption Registry: North Central US Stage validation report

Azure CLI PR: Azure/azure-cli#34147
PR head tested: 4bf37ec7b6e09bc5393e0eabb1817a648e770810
Live validation date: October 3, 2026
Region: North Central US (Stage)
Test environment: Non-production Azure test subscription; resource identifiers are intentionally omitted
Live CLI packaging: The live session started from the portable PR artifact and overlaid the PR''s custom.py as the two fixes landed. The final CI artifact was subsequently used to run the complete 70-test appservice mocked suite.

Outcome

The Azure CLI changes successfully validated Flex Consumption Registry deployment-storage configuration in North Central US Stage.

The live test covered:

• Registry-backed Function App creation
• Anonymous, Basic, user-assigned identity, and system-assigned identity configuration shapes
• Registry configuration reads
• Image tag and digest updates
• Authentication transitions
• Blob-to-Registry conversion
• Scale and general site-configuration updates
• Client-side invalid-argument validation
• Stage-location normalization
• Registry apps whose functionAppConfig.runtime is null

HTTP invocation could not be completed because the downstream stage platform did not yet support Registry-backed worker creation and assignment. This is a platform rollout dependency rather than an Azure CLI validation failure.

Result summary

Area	Result
Registry create, show, and update commands	Passed
Anonymous and Basic authentication configuration	Passed
User-assigned and system-assigned identity configuration shape	Passed; identity attachment was limited by the stage environment
Image tag and digest updates	Passed
Authentication transitions	Passed
Blob-to-Registry conversion	Passed
Scale update preserving Registry configuration	Passed
App settings and general configuration on a null-runtime Registry app	Passed after PR fix 4bf37ec7b
Invalid argument combinations	Passed; rejected before resource creation
Stage-region discovery and create	Passed after PR fix 416923fff
HTTP invocation	Blocked by downstream stage rollout
Registry config-zip behavior	Known follow-up; outside Registry deployment semantics

The detailed live matrix contained 54 report rows:

• 42 passed
• 3 superseded while the stage-location fix was refined
• 2 passed by reproducing the original bugs
• 2 stage-environment limits
• 2 blocked by the downstream platform rollout
• 1 expected/by-design rejection
• 1 defect discovered and fixed in this PR
• 1 known follow-up outside the main Registry flow

Changes verified in the PR

Stage-region normalization: 416923fff

Before the fix, the CLI intersected App Service stage names such as northcentralus(stage) with ARM names such as northcentralusstage without normalizing parentheses. Stage regions were therefore removed from the Flex Consumption location list, and create failed locally with Location is invalid.

The fix ignores parentheses only while matching the two location lists. It continues sending the App Service location name expected by the service.

Verified behavior:

• list-flexconsumption-locations includes northcentralus(stage) and centralus(stage).
• The zone-redundant location list remains unchanged.
• Runtime details can be read for stage locations.
• Blob-backed and Registry-backed Flex app creation reaches the service using the correct stage name.

Null-runtime handling: 4bf37ec7b

Registry-backed Flex apps return:

{
  "functionAppConfig": {
    "runtime": null,
    "deployment": {
      "storage": {
        "type": "Registry"
      }
    }
  }
}

Before the fix, az functionapp config appsettings set and az functionapp config set attempted to call .get() on the null runtime value and raised AttributeError before sending a request.

The fix treats a null runtime as undetected. The following commands then succeeded and preserved Registry deployment storage:

• az functionapp config appsettings set
• az functionapp config set
• az functionapp scale config set
• az functionapp config appsettings delete

Scenario matrix

Scenario	Expected	Actual
List Flex stage locations	App Service stage names are returned	Passed
Anonymous Registry create	Runtime is null; storage type is Registry; auth type is Anonymous	Passed
Basic Registry create	Setting names are stored without embedding credentials in deployment config	Passed
User-assigned identity configuration	UAI resource ID is stored in Registry authentication	Passed; attaching identity was unavailable in stage
System-assigned identity configuration	SystemAssignedIdentity auth type is stored	Passed; attaching identity was unavailable in stage
Deployment config show	Returns Registry image and authentication	Passed
Image tag update	New tag stored; authentication preserved	Passed
Image digest update	Digest reference stored; authentication preserved	Passed
Anonymous to Basic	Image preserved; Basic setting names added	Passed
Basic to UAI	Image preserved; Basic fields cleared; UAI ID added	Passed
UAI to system identity	Image preserved; UAI field cleared	Passed
System identity to Anonymous	Image preserved; identity fields cleared	Passed
Blank image update	Service rejects empty Registry image	Passed
Blob-only flags on Registry app	CLI rejects flags with actionable message	Passed
Runtime update on Registry app	CLI rejects because Registry storage has no language runtime	Passed
Scale update	Scale changes; Registry configuration remains unchanged	Passed
Blob-to-Registry update without auth	CLI rejects incomplete argument pair	Passed
Blob-to-Registry update with Anonymous auth	Runtime becomes null; storage changes to Registry	Passed
App settings update on Registry app	No null-runtime crash; Registry config preserved	Passed after fix
General site configuration update	No null-runtime crash; Registry config preserved	Passed after fix
Runtime plus image on create	CLI rejects before a write	Passed
Image without auth type	CLI rejects before a write	Passed
Basic without setting names	CLI rejects before a write	Passed
UAI auth without identity	CLI rejects before a write	Passed
Identity argument with non-UAI auth	CLI rejects before a write	Passed
Registry flags with classic Consumption	CLI rejects before a write	Passed
HTTP invocation	Worker pulls and starts Registry image	Blocked by downstream stage rollout

Representative commands

Resource names are replaced with variables.

Create an Anonymous Registry app

azpr functionapp create `
  --resource-group $ResourceGroup `
  --name $FunctionApp `
  --storage-account $StorageAccount `
  --flexconsumption-location 'northcentralus(stage)' `
  --deployment-image 'mcr.microsoft.com/azure-functions/dotnet8-quickstart-demo:1.0' `
  --deployment-image-auth-type Anonymous `
  --disable-app-insights `
  --query '{name:name,location:location,runtime:properties.functionAppConfig.runtime,storage:properties.functionAppConfig.deployment.storage}' `
  --output json

Read deployment configuration

azpr functionapp deployment config show `
  --resource-group $ResourceGroup `
  --name $FunctionApp `
  --output json

Verify null-runtime app-settings behavior

azpr functionapp config appsettings set `
  --resource-group $ResourceGroup `
  --name $FunctionApp `
  --settings FXR_PROBE=1 `
  --query "[?name=='FXR_PROBE'].name" `
  --output json

Verify client-side validation

azpr functionapp create `
  --resource-group $ResourceGroup `
  --name $NegativeApp `
  --storage-account $StorageAccount `
  --flexconsumption-location 'northcentralus(stage)' `
  --runtime python `
  --runtime-version 3.11 `
  --deployment-image 'mcr.microsoft.com/azure-functions/dotnet8-quickstart-demo:1.0' `
  --deployment-image-auth-type Anonymous

Expected: --deployment-image cannot be used with --runtime..., with no site created.

Automated validation

The appservice mocked command test file completed with 70/70 tests passing after the two fixes. This includes regression coverage for:

• Matching stage location names while preserving the App Service name sent to the service
• Updating app settings when a Registry app returns a null runtime

The final portable Windows artifact was also checked for the new create/update arguments and Azure CLI startup behavior.

Compatibility and rollout

The CLI changes are compatible with regions where Registry deployment storage is not enabled: the CLI sends the new payload, and the service returns its regional feature-gate response.

Mixed-version behavior observed during testing:

1. The CLI and App Service configuration path can accept and store Registry deployment configuration.
2. Worker creation and assignment require the corresponding downstream platform rollout.
3. Until that rollout completes, configuration operations can pass while HTTP invocation remains unavailable.

No CLI rollback is required for that platform condition. The regional service feature can remain disabled or be rolled back independently until downstream components are ready.

Remaining validation

After the downstream platform rollout reaches a test region, rerun:

1. Anonymous, Basic, UAI, and system-identity create
2. Registry configuration readback
3. Image pull
4. Worker assignment
5. HTTP invocation
6. Authentication transitions followed by invocation

The CLI configuration and validation portions are covered by the live and automated results above.

Highlights:

• Ran a 54-row live scenario matrix covering Registry create/read/update, Anonymous and Basic authentication, identity configuration shapes, tag/digest updates, authentication transitions, Blob-to-Registry conversion, scale/config preservation, and client-side validation.
• Confirmed the stage-location fix in 416923fff.
• Reproduced and fixed the null-runtime appsettings/config crash in 4bf37ec7b.
• Ran the complete appservice mocked command test file after the fixes: 70/70 passed.
• Registry configuration operations passed in stage. HTTP invocation remained blocked by a downstream stage rollout dependency, not by CLI argument handling.

Please review the scenario matrix, compatibility notes, and remaining end-to-end validation items included below.

[JaysonTaiMicrosoft]

pragatikushwaha Please fix the CI issues

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-codegen-extensibility-squad.

[x-engineering-agent]

pragatikushwaha

Review

The observed style failures are not PR-related: their task logs name unchanged ACS and SQL files, while this change is confined to App Service. No source change is requested for those failures; rerun or escalate the failing style workflows. No evidence-confirmed code or deterministic review-tool findings were identified on this head. This is not a merge approval.

Upstream CI

azdev-style

• Result: failure
• Relevance: Uncertain
• Evidence: The check completed without a concise diagnostic.
• Suggested fix: Open the linked log and confirm whether the first actionable error touches the PR diff before changing code.
• Verify: Re-run azdev-style and confirm it passes on the new head.

Azure.azure-cli

• Result: failure
• Included checks: Azure.azure-cli (Check CLI Style)
• Failure details:
  • Check CLI Style / Bash (Uncertain)
    • Evidence: src/azure-cli/azure/cli/command_modules/acs/custom.py:2946:11: W0718: Catching too general exception Exception (broad-exception-caught)
      src/azure-cli/azure/cli/command_modules/acs/custom.py:2964:11: W0718: Catching too general exception Exception (broad-exception-caught)
      ************* Module azure.cli.command_modules.acs.azurecontainerstorage._validators
      src/azure-cli/azure/cli/command_modules/acs/azurecontainerstorage/_validators.py:361:19: R0916: Too many boolean expressions in if statement (6/5) (too-many-boolean-expressions)

---

Your code has been rated at 10.00/10
ERROR: Pylint: FAILED
Running flake8 on modules...
Flake8: PASSED
- Next action: Address the first actionable diagnostic quoted from the task log; do not infer a source-code cause from the aggregate build status.
- Verify: Re-run Check CLI Style / Bash and confirm the quoted diagnostic is gone.

Evidence-based classification: Both azdev-style and Azure DevOps Check CLI Style / Bash are not PR-related. The initial diagnostic formatter marks relevance uncertain; the retrieved task log resolves that uncertainty. Run Azdev Style reports acs/custom.py:1087,2946,2964: W0718, acs/azurecontainerstorage/_validators.py:361: R0916, and sql/custom.py:1779: W0613, followed by ERROR: Pylint: FAILED, Flake8: PASSED, and exit code 12. None of those paths is changed here. The Azure DevOps task likewise quotes the ACS diagnostics above. Rerun both style validations against the current base or escalate these unrelated module diagnostics to their owners; do not alter App Service code merely to clear aggregate failures.

Test validation

• Agent live test: Not run; this is a review-only PR. Check author-provided test evidence and upstream CI separately.
• Regression coverage: For appservice: 2 focused test file(s) changed. Scenario coverage is unverified; review the issue's required conditions, test setup, and assertions before approval. Changed tests invoke az functionapp create, but invocation alone does not verify the required scenario or output. No linked issue was found in the PR timeline; inspect the source issue and its required scenario manually.

The changed src/azure-cli/azure/cli/command_modules/appservice/tests/latest/test_functionapp_commands.py:1772-1842 scenario asserts Registry create/config set/show and functionapp output. The focused mocks in tests/latest/test_appservice_utils.py exercise request payloads, API versions, partial updates, rejected inputs and preserved configuration. These are stronger than command invocation alone, but synthetic image digests do not establish a working live Registry deployment. No author-provided execution result was found in the PR description. The scenario is a LiveScenarioTest; no changed recording is not itself a defect. Before human approval, verify the service-shaped scenario's setup/output assertions and obtain focused execution evidence for Registry storage and compatibility with Blob storage. The author can run azdev test test_functionapp_commands.FunctionAppFlexConsumptionRegistryStorageTest --live and the focused test_appservice_utils tests through the repository's normal test workflow. This review did not dispatch or run Agent live tests.

Risk assessment

60/100 · High · High confidence

The High rating is driven by security-sensitive behavior, public CLI behavior, failure-handling behavior.

• Change scope: 7 changed files, 990 changed lines (+951 / -39), including 5 production files.
• Affected components: appservice
• Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18); failure-handling behavior (+12)
• Regression evidence: Changed regression tests are included, reducing risk.
• Confidence: High because changed-line patches were available for every production file.
• Required review: Owning-squad review is required for appservice before merge.

Posted by x-engineering-agent (Reviewer)

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-codegen-extensibility-squad.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[x-engineering-agent]

X Engineering Agent Report

Review — Comments

pragatikushwaha

Review

Upstream CI completed successfully for 1bf7258. The request/output tests cover Registry auth mapping, partial updates, rejection without writes, and preservation of Blob configuration. Regression coverage against the real service is not yet verified; no source defect was confirmed by the reviewed paths.

src/azure-cli/azure/cli/command_modules/appservice/tests/latest/test_functionapp_commands.py::FunctionAppScenarioTest::test_functionapp_flex_registry_deployment checks stored configuration, not successful image pull or a running deployment. Its synthetic digest does not establish image availability. No matching recording was added under src/azure-cli/azure/cli/command_modules/appservice/tests/latest/recordings/. The fake ARM transport in test_functionapp_commands_thru_mock.py echoes PUT payloads, so it cannot prove real API acceptance or that older-version GET/identity PUT paths preserve the new Registry fields.

Before merge, run and record the focused Registry scenario against the current head with a real resolvable image. Verify create/show and Blob-to-Registry transition, auth-mode changes, identity assign/remove, and scale/always-ready/update-strategy updates retain the image and setting-name references. Assert service acceptance and returned configuration through the actual API versions; add image-pull/runtime evidence if deployment success is claimed. Rerun the existing Blob scenario alongside it to protect compatibility.

Test validation

• Agent live test: Not run; this is a review-only PR. Check author-provided test evidence and upstream CI separately.
• Regression coverage: For appservice: 2 focused test file(s) changed. Scenario coverage is unverified; review the issue's required conditions, test setup, and assertions before approval. Changed tests invoke az functionapp create, but invocation alone does not verify the required scenario or output. No linked issue was found in the PR timeline; inspect the source issue and its required scenario manually.

Risk assessment

60/100 · High · High confidence

The High rating is driven by security-sensitive behavior, public CLI behavior, failure-handling behavior.

• Change scope: 7 changed files, 990 changed lines (+951 / -39), including 5 production files.
• Affected components: appservice
• Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18); failure-handling behavior (+12)
• Regression evidence: Changed regression tests are included, reducing risk.
• Confidence: High because changed-line patches were available for every production file.
• Required review: Owning-squad review is required for appservice before merge.

Posted by x-engineering-agent (Reviewer)

Live test — Failed

FAIL (exit 1)

Selectors: appservice.test_functionapp_flex_registry_deployment appservice.test_functionapp_commands_thru_mock (module)
PR head ref: byoc/flex-registry-functionappconfig
PR head sha: 1bf725888f5fbc628ff86f4acdbe90be12bfd5a0
PR base ref: dev
New test files in PR: false

Changed test files run

src/azure-cli/azure/cli/command_modules/appservice/tests/latest/test_functionapp_commands.py
src/azure-cli/azure/cli/command_modules/appservice/tests/latest/test_functionapp_commands_thru_mock.py

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/38658791926

Last 80 lines of azdev output

           ^^^^^^^^^^^^^^^^^^^^^
.venv/lib/python3.12/site-packages/azure/mgmt/storage/operations/_operations.py:6851: in begin_create
    raw_result = self._create_initial(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <azure.mgmt.storage.operations._operations.StorageAccountsOperations object at 0x7ff2a7188e90>
resource_group_name = 'clitest.rg2sdki7jz5fc57owylcm7eaeugwnxgynbbkw4mguhsskqg2tnussnhbvsuuv5qzbr3'
account_name = 'clitestjnpqatkx2q7uzzxkm'
parameters = {'sku': {'name': 'Standard_LRS'}, 'kind': 'Storage', 'location': 'westus', 'properties': {'encryption': {'keySource': 'Microsoft.Storage', 'services': {'blob': {}}}, 'supportsHttpsTrafficOnly': True, 'allowBlobPublicAccess': False}}
kwargs = {}

    def _create_initial(
        self,
        resource_group_name: str,
        account_name: str,
        parameters: Union[_models.StorageAccountCreateParameters, JSON, IO[bytes]],
        **kwargs: Any
    ) -> Iterator[bytes]:
        error_map: MutableMapping = {
            401: ClientAuthenticationError,
            404: ResourceNotFoundError,
            409: ResourceExistsError,
            304: ResourceNotModifiedError,
        }
        error_map.update(kwargs.pop("error_map", {}) or {})
    
        _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {})
        _params = kwargs.pop("params", {}) or {}
    
        content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None))
        cls: ClsType[Iterator[bytes]] = kwargs.pop("cls", None)
    
        content_type = content_type or "application/json"
        _content = None
        if isinstance(parameters, (IOBase, bytes)):
            _content = parameters
        else:
            _content = json.dumps(parameters, cls=SdkJSONEncoder, exclude_readonly=True)  # type: ignore
    
        _request = build_storage_accounts_create_request(
            resource_group_name=resource_group_name,
            account_name=account_name,
            subscription_id=self._config.subscription_id,
            content_type=content_type,
            api_version=self._config.api_version,
            content=_content,
            headers=_headers,
            params=_params,
        )
        path_format_arguments = {
            "endpoint": self._serialize.url("self._config.base_url", self._config.base_url, "str", skip_quote=True),
        }
        _request.url = self._client.format_url(_request.url, **path_format_arguments)
    
        _decompress = kwargs.pop("decompress", True)
        _stream = True
        pipeline_response: PipelineResponse = self._client._pipeline.run(  # pylint: disable=protected-access
            _request, stream=_stream, **kwargs
        )
    
        response = pipeline_response.http_response
    
        if response.status_code not in [200, 202]:
            try:
                response.read()  # Load the body in memory and close the socket
            except (StreamConsumedError, StreamClosedError):
                pass
            map_error(status_code=response.status_code, response=response, error_map=error_map)
            error = _failsafe_deserialize(
                _models.ErrorResponse,
                response,
            )
>           raise HttpResponseError(response=response, model=error, error_format=ARMErrorFormat)
E           azure.core.exceptions.HttpResponseError: (AccountKindNotSupported) Account Kind Storage is not supported.
E           Code: AccountKindNotSupported
E           Message: Account Kind Storage is not supported.

.venv/lib/python3.12/site-packages/azure/mgmt/storage/operations/_operations.py:6700: HttpResponseError
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
============================== 1 failed in 9.07s ===============================

Workflow run

Posted by x-engineering-agent (Tester)

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-codegen-extensibility-squad.