Flex Consumption Function App fails to start: Access to the path '/home/site/wwwroot/host.json' is denied

Hi airleben Leipzig - Thibaut Bouillon-Renaud,

Welcome to Microsoft Q&A Platform.

Thank you for your detailed description and troubleshooting steps.

The error you're encountering Access to the path '/home/site/wwwroot/host.json' is denied—is related to how deployment works on Azure Functions Flex Consumption plans. Let's break down the root cause and how to resolve it.

Root cause

Flex Consumption Function Apps use a different deployment model compared to classic Consumption or Premium plans. In Flex Consumption, the file system is read-only at runtime, and the app content is mounted from the deployment package stored in the associated storage account. This means:

• You cannot write to or modify files in /home/site/wwwroot at runtime.
• The platform expects your deployment package to be structured correctly and accessible.

The error message indicates that the function host process does not have permission to access host.json because of how the package is being deployed or mounted.

Please check the below settings

• WEBSITE_RUN_FROM_PACKAGE is not supported on Flex Consumption. Setting this can cause permission issues.
• Direct file system access (e.g., via Kudu/SSH) is not supported. All content must be deployed via supported methods.
• Deployment must use the correct method—for Flex Consumption, this is via ZIP Deploy or Azure DevOps/GitHub Actions, which place the package in the correct storage location.

To fix the issue:

Ensure Supported Deployment Method

• Use az functionapp deployment source config-zip (as you are doing), but make sure:
  • You are not setting WEBSITE_RUN_FROM_PACKAGE.
  • The ZIP package contains host.json at the root and all your function files.
• Check Storage Account Permissions
  • The storage account linked to your Function App must be accessible and not have firewall or network restrictions that block the platform.
  • The Function App's managed identity (if used) or the platform itself must have access to read the deployment package.
• Verify ZIP Package Structure
  • The host.json file must be at the root of the ZIP.

Example structure:

host.json 
function1/ 
  index.js 
  function.json 
node_modules/
package.json

Remove Unsupported App Settings

• Remove WEBSITE_RUN_FROM_PACKAGE if present.
• Do not manually add FUNCTIONS_WORKER_RUNTIME or FUNCTIONS_EXTENSION_VERSION—these are managed by the platform.

Check for Platform Issues

• If you previously hit a subscription quota error, ensure your subscription is not still blocked or in a failed provisioning state. You may need to open a support ticket with Azure if the issue persists after following the above steps.

References

• Deploy to Azure Functions Flex Consumption (Official Docs)
• Flex Consumption Known Issues
• Azure Functions Deployment Overview

Please "upvote" if the information helped you. This will help us and others in the community as well.

Thanks for the detailed reply! Unfortunately I had already tested/ruled out every point you listed before posting:

• WEBSITE_RUN_FROM_PACKAGE: not set (I did test setting it once as a experiment, saw no change, and removed it again).
• FUNCTIONS_WORKER_RUNTIME / FUNCTIONS_EXTENSION_VERSION: not present; when I tried adding FUNCTIONS_WORKER_RUNTIME manually the Portal itself rejected it ("...is invalid for Flex Consumption sites"), so this isn't configurable here at all.
• Storage RBAC (Storage Blob Data Contributor) + storage account key access: both already granted/enabled.
• Deployment method: already using az functionapp deployment source config-zip ... --build-remote true as documented.

I also followed up on your two other suggestions just now:

• ZIP structure: unzipped the exact deployed package locally — host.json and package.json are both correctly at the root, both valid JSON.
• Storage account network/firewall: checked in the Portal — "Public network access: Enabled", scope "Enabled from all networks". No restriction there either.

So all 9 hypotheses tested so far (7 from my original post + these 2) come back clean, and the function host still fails identically with "Access to the path '/home/site/wwwroot/host.json' is denied" on every fresh Function App I create.

Is there a way to get a deeper platform-side diagnostic on this ? (e.g. checking the actual file mount/package extraction logs on Microsoft's side)

Hi airleben Leipzig - Thibaut Bouillon-Renaud,

Thank you for performing those additional validations and for sharing the results.

Based on what you've described, you've already ruled out the common configuration and deployment-related causes.

Regarding your question, there are no customer-accessible diagnostics that expose the internal package mount or /home/site/wwwroot file system operations for Azure Functions Flex Consumption. If the Functions host fails before initialization (as in your case), the platform typically doesn't provide additional runtime logs beyond the host error you're seeing.

Since you've confirmed:

• The issue reproduces across multiple newly created Function Apps and Storage Accounts.
• The deployment package structure is correct (host.json at the root).
• Storage networking and permissions have been validated.
• The issue persists regardless of deployment method.

This behavior may indicate a platform-side issue rather than an application configuration issue.

To investigate further, we'll need to review the platform logs internally. Could you please provide the following details in private message.

• Function App name(s)
• Subscription ID
• Resource Group name(s)
• Approximate UTC timestamp of the most recent deployment attempt

Once we have these details, we'll review the backend diagnostics to determine why the host is unable to access host.json.

Hi airleben Leipzig - Thibaut Bouillon-Renaud,

Thank you for sharing the details.

Based on the information shared and the backend logs, could you please verify the following settings?

• Confirm that the Function App is not using the WEBSITE_RUN_FROM_PACKAGE app setting. This setting isn't supported for Flex Consumption Function Apps.
• If the Function App is configured with VNet Integration or Private Endpoints, please verify that the associated subnet names do not contain underscores (_), as this isn't supported for Flex Consumption networking scenarios.
• Confirm whether the Storage Account associated with the Function App has Storage Account Key Access enabled.

For reference, please review the Flex Consumption networking requirements:

https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options?tabs=azure-portal&pivots=flex-consumption-plan#restricting-your-storage-account-to-a-virtual-network

Please let us know the outcome after verifying these settings, and we'll continue investigating if the issue persists.

Please "upvote" if the information helped you. This will help us and others in the community as well.

Hi @Vallepu Venkateswarlu

The answer is not relevant for this topic. Can please check again