logic app: resource tag policy prevents from creating outlook connector

Question

Hello,

Our subscription has a policy that requires to add an 'Owner' tag to every Azure resource. Today I created a Logic App with this tag and there was no problem. Then I tried to add a step with an outlook.com connector and after clicking the sign in button I got the following error:

"Failed to create connection for connection id '/subscriptions/[our subscription]/resourceGroups/[our resource group]/providers/Microsoft.Web/connections/outlook'. Resource 'outlook' was disallowed by policy. Reasons: 'All resources must have tag: Owner with value assigned, which should be name and surname of the resource owner'. See error details for policy resource IDs."

So it seems like Azure treated this connector as a resource, but I can't really add this tag anywhere. The same happened for outlook365 and gmail connectors.

I googled for solution but without luck. Has anyone encountered such problem or knows what to do with it? Thanks in advance.

Answer 1

@Anonymous Before you can use a connector's triggers or actions in your workflow, most connectors require that you first create a connection to the target service or system. To create a connection from within a logic app workflow, you have to authenticate your identity with account credentials and sometimes other connection information.

When you authenticate any connectors internally it creates the API Connections resource and you can find all the connections details under API Connections in the Azure portal as below.

As there is a policy set by your admin when you authenticate the connector it tries to create the resource but as the tags cannot be added while creating the API connections resource, therefore, you have observed the below error.

"Failed to create connection for connection id '/subscriptions/[our subscription]/resourceGroups/[our resource group]/providers/Microsoft.Web/connections/outlook'. Resource 'outlook' was disallowed by policy. Reasons: 'All resources must have tag: Owner with value assigned, which should be name and surname of the resource owner'. See error details for policy resource IDs."

You need to work with your policy admin that they need to modify the policy to except this API Connections resource (Microsoft.Web/connections) or they can try to disable the policy for some time if they cannot modify their existing policy so you can create the API connection for your logic app.