Authenticate access to Azure resources with managed identities in Azure Logic Apps

Some triggers and actions in logic app workflows support using a managed identity, previously known as a Managed Service Identity (MSI), to authenticate connections to resources protected by Azure Active Directory (Azure AD). When your logic app resource has a managed identity enabled, you don't have to provide credentials, secrets, or Azure AD tokens. Azure manages this identity and helps keep authentication information secure because you don't have to manage this sensitive information.

Azure Logic Apps supports the system-assigned managed identity, which you can use with only one logic app resource, and the user-assigned managed identity, which you can share across a group of logic app resources, based on where your logic app workflows run.

To learn about managed identity limits in Azure Logic Apps, review Limits on managed identities for logic apps. For more information about the Consumption and Standard logic app resource types and environments, review the following documentation:

• What is Azure Logic Apps?
• Single-tenant versus multi-tenant and integration service environment
• Azure Arc enabled Logic Apps

Where you can use a managed identity

Only specific built-in and managed connector operations that support Azure AD Open Authentication (Azure AD OAuth) can use a managed identity for authentication. The following table provides only a sample selection. For a more complete list, review Authentication types for triggers and actions that support authentication and Azure services that support Azure AD authentication with managed identities.

This article shows how to enable and set up the system-assigned identity or user-assigned identity, based on whether you're using the Logic App (Consumption) or Logic App (Standard) resource type. Unlike the system-assigned identity, which you don't have to manually create, you do have to manually create the user-assigned identity for the Logic App (Consumption) resource type. This article includes the steps to create the user-assigned identity using the Azure portal and Azure Resource Manager template (ARM template). For Azure PowerShell, Azure CLI, and Azure REST API, review the following documentation:

Prerequisites

• An Azure account and subscription. If you don't have a subscription, sign up for a free Azure account. Both the managed identity and the target Azure resource where you need access must use the same Azure subscription.

• To give a managed identity access to an Azure resource, you need to add a role to the target resource for that identity. To add roles, you need Azure AD administrator permissions that can assign roles to identities in the corresponding Azure AD tenant.

• The target Azure resource that you want to access. On this resource, you'll add a role for the managed identity, which helps the logic app resource or connection authenticate access to the target resource.

• The logic app resource where you want to use the trigger or actions that support managed identities.

  Logic app resource type	Managed identity support
  Consumption	System-assigned or user-assigned identity
  Standard	System-assigned identity (automatically enabled)

Enable system-assigned identity in Azure portal

Enable system-assigned identity in an ARM template

To automate creating and deploying Azure resources such as logic apps, you can use an ARM template. To enable the system-assigned managed identity for your logic app resource in the template, add the identity object and the type child property to the logic app's resource definition in the template, for example:

{
   "apiVersion": "2016-06-01",
   "type": "Microsoft.logic/workflows",
   "name": "[variables('logicappName')]",
   "location": "[resourceGroup().location]",
   "identity": {
      "type": "SystemAssigned"
   },
   "properties": {},
   <...>
}

{
   "apiVersion": "2021-01-15",
   "type": "Microsoft.Web/sites",
   "name": "[variables('sites_<logic-app-resource-name>_name')]",
   "location": "[resourceGroup().location]",
   "kind": "functionapp,workflowapp",
   "identity": {
      "type": "SystemAssigned"
   },
   "properties": {},
   <...>
}

When Azure creates your logic app resource definition, the identity object gets these other properties:

"identity": {
   "type": "SystemAssigned",
   "principalId": "<principal-ID>",
   "tenantId": "<Azure-AD-tenant-ID>"
}

Create user-assigned identity in the Azure portal (Consumption only)

Before you can enable the user-assigned identity on your Logic App (Consumption) resource, you have to first create that identity as a separate Azure resource.

1. In the Azure portal search box, enter managed identities. Select Managed Identities.

   

2. On the Managed Identities pane, select Create.

   

3. Provide information about your managed identity, and then select Review + Create, for example:

   

   Property	Required	Value	Description
   Subscription	Yes	<Azure-subscription-name>	The name for the Azure subscription to use
   Resource group	Yes	<Azure-resource-group-name>	The name for the Azure resource group to use. Create a new group, or select an existing group. This example creates a new group named fabrikam-managed-identities-RG.
   Region	Yes	<Azure-region>	The Azure region where to store information about your resource. This example uses West US.
   Name	Yes	<user-assigned-identity-name>	The name to give your user-assigned identity. This example uses Fabrikam-user-assigned-identity.

   After validating the information, Azure creates your managed identity. Now you can add the user-assigned identity to your logic app resource, which can have only one user-assigned identity.

4. In the Azure portal, open your logic app resource.

5. On the logic app menu, under Settings, select Identity.

6. On the Identity pane, select User assigned > Add.

   

7. On the Add user assigned managed identity pane, follow these steps:

   1. From the Subscription list, select your Azure subscription, if not already selected.

   2. From the list with all the managed identities in that subscription, select the user-assigned identity that you want. To filter the list, in the User assigned managed identities search box, enter the name for the identity or resource group.

      

   3. When you're done, select Add.

      Note

      If you get an error that you can have only a single managed identity, your logic app is already associated with the system-assigned identity. Before you can add the user-assigned identity, you have to first disable the system-assigned identity.

   Your logic app is now associated with the user-assigned managed identity.

   

8. Now follow the steps that give that identity access to the resource later in this topic.

Create user-assigned identity in an ARM template (Consumption only)

To automate creating and deploying Azure resources such as logic apps, you can use an ARM template, which support user-assigned identities for authentication. In your template's resources section, your logic app's resource definition requires these items:

• An identity object with the type property set to UserAssigned

• A child userAssignedIdentities object that specifies the user-assigned resource and name

This example shows a logic app resource definition for an HTTP PUT request and includes a non-parameterized identity object. The response to the PUT request and subsequent GET operation also have this identity object:

{
   "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
   "contentVersion": "1.0.0.0",
   "parameters": {<template-parameters>},
   "resources": [
      {
         "apiVersion": "2016-06-01",
         "type": "Microsoft.logic/workflows",
         "name": "[variables('logicappName')]",
         "location": "[resourceGroup().location]",
         "identity": {
            "type": "UserAssigned",
            "userAssignedIdentities": {
               "/subscriptions/<Azure-subscription-ID>/resourceGroups/<Azure-resource-group-name>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<user-assigned-identity-name>": {}
            }
         },
         "properties": {
            "definition": {<logic-app-workflow-definition>}
         },
         "parameters": {},
         "dependsOn": []
      },
   ],
   "outputs": {}
}

If your template also includes the managed identity's resource definition, you can parameterize the identity object. This example shows how the child userAssignedIdentities object references a userAssignedIdentity variable that you define in your template's variables section. This variable references the resource ID for your user-assigned identity.

{
   "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
   "contentVersion": "1.0.0.0",
   "parameters": {
      "Template_LogicAppName": {
         "type": "string"
      },
      "Template_UserAssignedIdentityName": {
         "type": "securestring"
      }
   },
   "variables": {
      "logicAppName": "[parameters(`Template_LogicAppName')]",
      "userAssignedIdentityName": "[parameters('Template_UserAssignedIdentityName')]"
   },
   "resources": [
      {
         "apiVersion": "2016-06-01",
         "type": "Microsoft.logic/workflows",
         "name": "[variables('logicAppName')]",
         "location": "[resourceGroup().location]",
         "identity": {
            "type": "UserAssigned",
            "userAssignedIdentities": {
               "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/', variables('userAssignedIdentityName'))]": {}
            }
         },
         "properties": {
            "definition": {<logic-app-workflow-definition>}
         },
         "parameters": {},
         "dependsOn": [
            "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/', variables('userAssignedIdentityName'))]"
         ]
      },
      {
         "apiVersion": "2018-11-30",
         "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
         "name": "[parameters('Template_UserAssignedIdentityName')]",
         "location": "[resourceGroup().location]",
         "properties": {}
      }
  ]
}

Give identity access to resources

Before you can use your logic app's managed identity for authentication, on the Azure resource where you want to use the identity, you have to set up access for your identity by using Azure role-based access control (Azure RBAC). The steps in this section cover how to assign the appropriate role to that identity on the Azure resource using the Azure portal and Azure Resource Manager template (ARM template). For Azure PowerShell, Azure CLI, and Azure REST API, review the following documentation:

Assign managed identity role-based access in the Azure portal

On the Azure resource where you want to use the managed identity for authentication, you have to assign that identity to a role that can access that target resource. For more general information about this task, review Assign a managed identity access to another resource using Azure RBAC.

1. In the Azure portal, open the resource where you want to use the identity.

2. On the resource's menu, select Access control (IAM) > Add > Add role assignment.

   Note

   If the Add role assignment option is disabled, you don't have permissions to assign roles. For more information, review Azure AD built-in roles.

3. Now, assign the necessary role to your managed identity. On the Role tab, assign a role that gives your identity the required access to the current resource.

   For this example, assign the role that's named Storage Blob Data Contributor, which includes write access for blobs in an Azure Storage container. For more information about specific storage container roles, review Roles that can access blobs in an Azure Storage container.

4. Next, choose the managed identity where you want to assign the role. Under Assign access to, select Managed identity > Add members.

5. Based on your managed identity's type, select or provide the following values:

   Type	Azure service instance	Subscription	Member
   System-assigned	Logic App	<Azure-subscription-name>	<your-logic-app-name>
   User-assigned (Consumption only)	Not applicable	<Azure-subscription-name>	<your-user-assigned-identity-name>

   For more information about assigning roles, review the documentation, Assign roles using the Azure portal.

6. After you finish setting up access for the identity, you can then use the identity to authenticate access for triggers and actions that support managed identities.

Authenticate access with managed identity

After you enable the managed identity for your logic app resource and give that identity access to the target resource or entity, you can use that identity in triggers and actions that support managed identities.

These steps show how to use the managed identity with a trigger or action through the Azure portal. To specify the managed identity in a trigger or action's underlying JSON definition, review Managed identity authentication.

Example: Authenticate built-in trigger or action with a managed identity

The built-in HTTP trigger or action can use the system-assigned identity that you enable on your logic app resource. In general, the HTTP trigger or action uses the following properties to specify the resource or entity that you want to access:

As a specific example, suppose that you want to run the Snapshot Blob operation on a blob in the Azure Storage account where you previously set up access for your identity. However, the Azure Blob Storage connector doesn't currently offer this operation. Instead, you can run this operation by using the HTTP action or another Blob Service REST API operation.

To run the Snapshot Blob operation, the HTTP action specifies these properties:

Example: Authenticate managed connector trigger or action with a managed identity

The Azure Resource Manager managed connector has an action, Read a resource, that can use the managed identity that you enable on your logic app resource. This example shows how to use the system-assigned managed identity.

Logic app resource definition and connections that use a managed identity (Consumption)

A connection that enables and uses a managed identity are a special connection type that works only with a managed identity. At runtime, the connection uses the managed identity that's enabled on the logic app resource. At runtime, the Azure Logic Apps service checks whether any managed connector trigger and actions in the logic app workflow are set up to use the managed identity and that all the required permissions are set up to use the managed identity for accessing the target resources that are specified by the trigger and actions. If successful, Azure Logic Apps retrieves the Azure AD token that's associated with the managed identity and uses that identity to authenticate access to the target resource and perform the configured operation in trigger and actions.

"parameters": {
   "$connections": {
      "value": {
         "<action-name>": {
            "connectionId": "/subscriptions/{Azure-subscription-ID}/resourceGroups/{resource-group-name}/providers/Microsoft.Web/connections/{connection-name}",
            "connectionName": "{connection-name}",
            "connectionProperties": {
               "authentication": {
                  "type": "ManagedServiceIdentity"
               }
            },
            "id": "/subscriptions/{Azure-subscription-ID}/providers/Microsoft.Web/locations/{Azure-region}/managedApis/{managed-connector-type}"
         }
      }
   }
}

"parameters": {
   "$connections": {
      "value": {
         "<action-name>": {
            "connectionId": "/subscriptions/{Azure-subscription-ID}/resourceGroups/{resource-group-name}/providers/Microsoft.Web/connections/{connection-name}",
            "connectionName": "{connection-name}",
            "connectionProperties": {
               "authentication": {
                  "identity": "/subscriptions/{Azure-subscription-ID}/resourceGroups/{resourceGroupName}/providers/microsoft.managedidentity/userassignedidentities/{managed-identity-name}",
                  "type": "ManagedServiceIdentity"
               }
            },
            "id": "/subscriptions/{Azure-subscription-ID}/providers/Microsoft.Web/locations/{Azure-region}/managedApis/{managed-connector-type}"
         }
      }
   }
}

{
    "managedApiConnections": {
        "<connector-name>": {
            "api": {
                "id": "/subscriptions/{Azure-subscription-ID}/providers/Microsoft.Web/locations/{region}/managedApis/<connector-name>"
            },
            "connection": {
                "id": "/subscriptions/{Azure-subscription-ID}/resourceGroups/{resource-group-name}/providers/Microsoft.Web/connections/<connection-name>"
            },
            "connectionRuntimeUrl": <connection-URL>,
            "authentication": { // Authentication with APIHub
                "type": "ManagedServiceIdentity"
            },
            "connectionProperties": {
                "authentication": { //Authentication with the target resource
                    "type": "ManagedServiceIdentity",
                    "identity": "<user-assigned-identity>", // Optional
                    "audience": "<resource-URL>"
                }
            }
        }
    }
}

ARM template for managed connections and managed identities (Consumption)

If you automate deployment with an ARM template, and your logic app workflow includes a managed connector trigger or action that uses a managed identity, confirm that the underlying connection resource definition includes the parameterValueType property with Alternative as the property value. Otherwise, your ARM deployment won't set up the connection to use the managed identity for authentication, and the connection won't work in your logic app's workflow. This requirement applies only to specific managed connector triggers and actions where you selected the Connect with managed identity option.

For example, here's the underlying connection resource definition for an Azure Automation action that uses a managed identity where the definition includes the parameterValueType property, which is set to Alternative as the property value:

{
    "type": "Microsoft.Web/connections",
    "name": "[variables('automationAccountApiConnectionName')]",
    "apiVersion": "2016-06-01",
    "location": "[parameters('location')]",
    "kind": "V1",
    "properties": {
        "api": {
            "id": "[subscriptionResourceId('Microsoft.Web/locations/managedApis', parameters('location'), 'azureautomation')]"
        },
        "customParameterValues": {},
        "displayName": "[variables('automationAccountApiConnectionName')]",
        "parameterValueType": "Alternative"
    }
},

Disable managed identity

To stop using the managed identity for authentication, first remove the identity's access to the target resource. Next, on your logic app resource, turn off the system-assigned identity or remove the user-assigned identity.

When you disable the managed identity on your logic app resource, you remove the capability for that identity to request access for Azure resources where the identity had access.

The steps in this section cover using the Azure portal and Azure Resource Manager template (ARM template). For Azure PowerShell, Azure CLI, and Azure REST API, review the following documentation:

Disable managed identity in the Azure portal

To remove access for the managed identity, remove the identity's role assignment from the target resource, and then disable the managed identity.

Remove role assignment

The following steps remove access to the target resource from the managed identity:

1. In the Azure portal, go to the target Azure resource where you want to remove access for the managed identity.

2. From the target resource's menu, select Access control (IAM). Under the toolbar, select Role assignments.

3. In the roles list, select the managed identities that you want to remove. On the toolbar, select Remove.

   Tip

   If the Remove option is disabled, you most likely don't have permissions. For more information about the permissions that let you manage roles for resources, review Administrator role permissions in Azure Active Directory.

Disable managed identity on logic app resource

1. In the Azure portal, open your logic app resource.

2. On the logic app navigation menu, under Settings, select Identity, and then follow the steps for your identity:

   • Select System assigned > On > Save. When Azure prompts you to confirm, select Yes.

   • Select User assigned and the managed identity, and then select Remove. When Azure prompts you to confirm, select Yes.

Disable managed identity in an ARM template

If you created the logic app's managed identity by using an ARM template, set the identity object's type child property to None.

"identity": {
   "type": "None"
}

Next steps

• Secure access and data in Azure Logic Apps