Can Azure Functions app have Required Authentication but exlucde specific endpoints?

Hi @Richard Mackriell - You're not missing it — excludedPaths isn't exposed in the Authentication blade. It's a property of the authsettingsV2 resource, so you set it through ARM rather than the portal UI.

Filling in the config from previous answer

{
  "properties": {
    "globalValidation": {
      "requireAuthentication": true,
      "unauthenticatedClientAction": "Return401",
      "excludedPaths": [
        "/api/public-endpoint"
      ]
    }
  }
}

To apply it, edit the Microsoft.Web/sites/<your-app>/config/authsettingsV2 resource — either in an ARM or Bicep template, or interactively through Azure Resource Explorer, which lets you PUT the JSON directly without writing a template.

Return401 is the right value for an API — the ARM reference lists AllowAnonymous, RedirectToLoginPage, Return401 and Return403, and the redirect is for browser apps.

You still want [HttpTrigger(AuthorizationLevel.Anonymous, ...)] on that endpoint, as noted above. The two are separate layers: the excluded path covers App Service Auth, the trigger's auth level covers the Functions runtime. Both have to permit the request.

Hi @Richard Mackriell

Yes it's possible attached the step for your understanding.

Step 1 — Enable App Service Authentication

Azure Portal → Your Function App → Authentication

• Identity provider: Microsoft Entra ID
• Action to take when request is not authenticated: Require authentication

Step 2 — Add an “Allow Anonymous” rule for one function

In the Authentication blade → Edit configuration → Add a rule:

Example for a function named PublicPing:

{
  "routes": [
    {
      "path": "/api/PublicPing",
      "allowedUnauthenticatedAccess": true
    }
  ]
}

1. /api/PublicPing → allow anonymous
2. Everything else → require login

Step 3 — Set the function’s authorization level to anonymous

function.json:

json

{
  "authLevel": "anonymous",
  "type": "httpTrigger",
  "direction": "in"
}

Now the function accepts anonymous requests after Easy Auth allows them.

Thanks.

Yes, it is possible, but not only from the basic portal toggle.

When App Service Authentication is set to Require authentication, it applies to all calls to the Function App before the request reaches your function code. So setting one HTTP trigger to authLevel: anonymous is not enough by itself, because App Service Authentication can still intercept the request first.

For this requirement, you have two common options:

1. Keep App Service Authentication enabled and configure an excluded path for the anonymous endpoint.
2. Change App Service Authentication to Allow unauthenticated requests, then enforce authentication in your function code for all endpoints except the one public endpoint.

For option 1, the exclusion is configured in the App Service auth settings, for example with authsettingsV2 / file-based auth configuration. The path should match the public function route, such as:

{
  "globalValidation": {
    "requireAuthentication": 
    "unauthenticatedClientAction": 
    "excludedPaths": [
      
    ]
  }
}

Also make sure that the specific HTTP trigger uses anonymous/function-level settings appropriately, for example:

[HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "public-endpoint")]