Access to the path ‘D:\home\site\wwwroot\host.json’ is denied.

If you a receive a System.UnauthorizedAccessException with a message Access to the path ‘D:\home\site\wwwroot\host.json’ is denied, then it likely means you have a network configuration which is blocking access to the Azure Storage Account on which your Azure Function is hosted.  Perform the following to check and see if this could be the case.

Check out this article which is helpful with validation your Azure Function configuration settings.   Validating Azure Function Application Setting Configuration, fail to trigger

First, identify the Azure Storage Account you are using with your Azure Function.


Figure 1, what is the storage account associated with my Azure Function

The value assigned to the AccountName parameter is the Azure Storage Account name.  Navigate to that and open the Networking blade.


Figure 2, VNET blocking the deployment of an Azure Function

Notice that the Selected networks radio button is selected.  This means that the Azure Storage Account is protected by the VNET.  The fact that you see no network configuration is the first clue something is wrong.  Actually, it is the only clue you need because this won’t work and is a incorrect configuration.  If the Azure Function is running in a tier which support VNETs, then that Azure Function needs to be in the same VNET as the Azure Storage Account.  The Azure Function in Figure 1 is in Dynamic / Consumption mode so there is no way to make this configuration work because VNET is only supported in Premium / Elastic or Dedicated Standard+.  Therefore, either change the pricing tier of the Azure Function, select the All networks radio button or change the WEBSITE_CONTENTAZUREFILECONNECTIONSTRING application setting so it references an Azure Storage Account not contained within a VNET.

If your Azure Function is in a tier which supports VNET integration, check the Networking blade for the Azure Function.


Figure 3, check the network VNET integration for an Azure Function

Take note of the names and make sure those are the names.  If not, the access is likely being blocked.


Figure 4, check the network VNET integration for an Azure Function