sasAuthenticationPolicy JSON object disable in Logic App

Question

hi,

anyone has a working example on hop to patch a Logic App to disable SAS token ?

https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal&ref=hybridbrothers.com#add-the-sasauthenticationpolicy-property-to-your-workflow-definition

{
  "properties": {
    "definition": {
      "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "$connections": {
          "defaultValue": {},
          "type": "Object"
        }
      },
      "triggers": {
        "When_a_HTTP_request_is_received": {
          "type": "Request",
          "kind": "Http",
          "inputs": {
            "method": "POST",
            "schema": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "id": {
                    "type": "string"
                  },
                  "topic": {
                    "type": "string"
                  },
                  "subject": {
                    "type": "string"
                  },
                  "data": {
                    "type": "object",
                    "properties": {
                      "timestamp": {
                        "type": "string"
                      },
                      "policyAssignmentId": {
                        "type": "string"
                      },
                      "policyDefinitionId": {
                        "type": "string"
                      },
                      "policyDefinitionReferenceId": {
                        "type": "string"
                      },
                      "complianceState": {
                        "type": "string"
                      },
                      "subscriptionId": {
                        "type": "string"
                      },
                      "complianceReasonCode": {
                        "type": "string"
                      }
                    }
                  },
                  "eventType": {
                    "type": "string"
                  },
                  "eventTime": {
                    "type": "string"
                  },
                  "dataVersion": {
                    "type": "string"
                  },
                  "metadataVersion": {
                    "type": "string"
                  }
                },
                "required": [
                  "id",
                  "topic",
                  "subject",
                  "data",
                  "eventType",
                  "eventTime",
                  "dataVersion",
                  "metadataVersion"
                ]
              }
            }
          },
          "conditions": [
            {
              "expression": "@startsWith(triggerOutputs()?['headers']?['Authorization'], 'Bearer')"
            }
          ],
          "operationOptions": "EnableSchemaValidation, IncludeAuthorizationHeadersInOutputs"
        }
      },
      "actions": {},
      "outputs": {}
    },
    "parameters": {
      "$connections": {
        "value": {}
      }
    },
    "accessControl": {
      "triggers": {
        "openAuthenticationPolicies": {
          "policies": {
            "etst": {
              "type": "AAD",
              "claims": [
                {
                  "name": "iss",
                  "value": "https://sts.windows.net/tennt-id-goes-here/"
                }
              ]
            }
          }
        },
        "sasAuthenticationPolicy": {
          "state": "Disabled"
        }
      }

getting

{

"error": {

"code": "PatchWorkflowPropertiesNotSupported",

"message": "The request to patch workflow 'Logic App' is not supported. None of the fields inside the properties object can be patched."

}

}

anyone ?

Answer 1

Hello AdamBudzinskiAZA-0329,

Thank you for posting your question in the Microsoft Q&A forum. 

The error occurs because Azure Logic Apps do not support direct PATCH operations on workflow properties. Instead, you must update the entire Logic App definition via an ARM template or PUT request. To disable SAS tokens: 

• Export your Logic App’s JSON definition (via Azure Portal or GET API call). 
• Add/modify the sasAuthenticationPolicy property under accessControl.triggers as shown in your example. 
• Redeploy the updated JSON using an ARM template deployment or PUT request to the Logic App’s resource endpoint. 

Key Notes: 

• Use PUT (not PATCH) to overwrite the entire definition. 
• Validate the JSON structure to avoid syntax errors. 
• Consider Azure Policy or DevOps pipelines for automated enforcement. 

If the above answer helped, please do not forget to "Accept Answer" as this may help other community members to refer the info if facing a similar issue. Your contribution to the Microsoft Q&A community is highly appreciated.

Answer 2

Hello AdamBudziski-8216,

The issue arises due to a fundamental limitation in how Azure Event Grid interacts with Logic Apps (Consumption) when OAuth authentication is enforced. While Logic Apps support disabling SAS-based authentication in favor of OAuth (Bearer tokens), Event Grid’s webhook delivery mechanism does not yet support sending events with OAuth tokens to Consumption-tier Logic Apps. Instead, Event Grid relies on SAS tokens for authentication when invoking Logic App HTTP triggers. 

This creates a conflict: If SAS is disabled, Event Grid cannot deliver events, yet enabling SAS reintroduces security risks. The problem does not exist in Logic Apps (Standard), which supports Managed Identity authentication for Event Grid. However, Consumption Logic Apps lack this capability, forcing users to either re-enable SAS (with manual token validation) or introduce an intermediary service (like Azure Functions) to handle OAuth authentication before forwarding events.  

There are few alternatives you may try, as I have provided below options: 

Option 1: Re-enable SAS (Temporarily) & Use Event Grid Validation 

• Re-enable SAS in your Logic App (either via ARM template or the portal). 
• Configure an Event Grid subscription using the SAS-based URL. 
• Add manual OAuth validation inside the Logic App: 
  • Use an "HTTP Request" trigger (instead of the built-in Event Grid trigger). 
  • Add a "Parse JSON" action to extract the Authorization header. 
  • Use a "Condition" action to validate the Bearer token (if present). 
  • If the token is missing/invalid, reject the request. 

Option 2: Use an Intermediate Azure Function (Recommended) - Since Event Grid does support OAuth for Azure Functions, you can: 

Create an Azure Function with an Event Grid trigger. 

Configure OAuth (Bearer token) authentication for the Function. 

Forward the event to your Logic App (using its OAuth-protected endpoint). 

This way, Event Grid authenticates with the Function (OAuth), and the Function forwards the event to the Logic App (also OAuth). 

If the above answer helped, please do not forget to "Accept Answer" as this may help other community members to refer the info if facing a similar issue. Your contribution to the Microsoft Q&A community is highly appreciated.