data.function_app - export the identity block

azurerm/internal/services/web/data_source_function_app.go

@@ -115,6 +115,29 @@ func dataSourceArmFunctionApp() *schema.Resource {
 
 			"source_control": schemaDataSourceAppServiceSiteSourceControl(),
 
+			"identity": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"type": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+
+						"principal_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+
+						"tenant_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+
 			"tags": tags.Schema(),
 		},
 	}
@@ -204,6 +227,10 @@ func dataSourceArmFunctionAppRead(d *schema.ResourceData, meta interface{}) erro
 		return err
 	}
 
+	if err := d.Set("identity", flattenFunctionAppIdentity(resp.Identity)); err != nil {
+		return fmt.Errorf("setting `identity`: %+v", err)
+	}
+
 	siteCred := flattenFunctionAppSiteCredential(siteCredResp.UserProperties)
 	if err = d.Set("site_credential", siteCred); err != nil {
 		return err

azurerm/internal/services/web/function_app.go

@@ -488,3 +488,27 @@ func flattenFunctionAppSiteCredential(input *web.UserProperties) []interface{} {
 
 	return append(results, result)
 }
+
+func flattenFunctionAppIdentity(input *web.ManagedServiceIdentity) []interface{} {
+	if input == nil {
+		return []interface{}{}
+	}
+
+	principalID := ""
+	if input.PrincipalID != nil {
+		principalID = *input.PrincipalID
+	}
+
+	tenantID := ""
+	if input.TenantID != nil {
+		tenantID = *input.TenantID
+	}
+
+	return []interface{}{
+		map[string]interface{}{
+			"type":         string(input.Type),
+			"principal_id": principalID,
+			"tenant_id":    tenantID,
+		},
+	}
+}

azurerm/internal/services/web/tests/resource_arm_function_app_test.go

@@ -32,6 +32,10 @@ func TestAccAzureRMFunctionApp_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(data.ResourceName, "version", "~1"),
 					resource.TestCheckResourceAttrSet(data.ResourceName, "outbound_ip_addresses"),
 					resource.TestCheckResourceAttrSet(data.ResourceName, "possible_outbound_ip_addresses"),
+					resource.TestCheckResourceAttr(data.ResourceName, "identity.#", "1"),
+					resource.TestCheckResourceAttr(data.ResourceName, "identity.0.type", "SystemAssigned"),
+					resource.TestCheckResourceAttrSet(data.ResourceName, "identity.0.principal_id"),
+					resource.TestCheckResourceAttrSet(data.ResourceName, "identity.0.tenant_id"),
 				),
 			},
 			data.ImportStep(),

website/docs/d/function_app.html.markdown

@@ -44,6 +44,8 @@ The following attributes are exported:
 
 * `enabled` - Is the Function App enabled?
 
+* `identity` - A `identity` block as defined below.
+
 * `site_credential` - A `site_credential` block as defined below, which contains the site-level credentials used to publish to this App Service.
 
 * `os_type` - A string indicating the Operating System type for this function app.
@@ -142,6 +144,15 @@ A `source_control` block exports the following:
 
 * `use_mercurial` - Uses Mercurial if `true`, otherwise uses Git. 
 
+---
+
+An `identity` block exports the following:
+
+* `principal_id` - The ID of the System Managed Service Principal assigned to the function app.
+
+* `tenant_id` - The ID of the Tenant of the System Managed Service Principal assigned to the function app.
+
+* `type` - The identity type of the Managed Identity assigned to the function app.
 
 ## Timeouts