Logic App SQL Connection is not set up to use Managed Identity

Question

Been stuck on this one for quite some time .. We already deploy Logic App API Connections which use managed identity (Service bus , Eventgrid , ...) through bicep code and they are all working as expected.

What I did now is I manually configured an SQL Logic App API Connection on the Azure Portal and it's working as expected. But when templating it to bicep, it is giving me more than a 1000 headaches.

Manually configured connection in the portal provides me with:

However my current bicep code:

resource con_XXXXXX_sql 'Microsoft.Web/connections@2016-06-01' = {
  name: sqlConnectionName
  location: location
  properties: {
    displayName: sqlConnectionName
    customParameterValues: {}
    api: {
      id: subscriptionResourceId('Microsoft.Web/locations/managedApis', location, 'sql')
      type: 'Microsoft.Web/locations/managedApis'
    }
    parameterValueSet: {
      name: 'managedIdentityAuth'
      values: {}
    }
  }
}

Is resulting in:

To be fair, it should not be hard to find an answer on this for what the possible values of 'Authentication' can be for your connection and how you should deploy the different types of Authentication ..

Things i've tried:

• Exporting the template of that 'manually created connection' on the Resource Group does not provide me with a good solution since it's not the same as it is configured
• adding 'authType' with different values also did not work since it then tries Windows / Basic / Sql / other Authentication methods than the one i want (which is User Assigned Managed Identity)
• I am calling my SQL Connection correctly in my logic app since the manually created connection is giving no issues.
• AI Suggests:

parameterValueSet: {
      name: 'managedIdentityAuth'
      values: {}
      identity: '/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<managed-identity-name>'
    }

• ^ Not working

The Error:

The $connections in my LogicApp:

sql: {
            connectionId: existing_con_kyriba_sql.id
            connectionName: existing_con_kyriba_sql.name
            id: subscriptionResourceId('Microsoft.Web/locations/managedApis', location, 'sql')
            connectionProperties: {
              authentication: {
                type: 'ManagedServiceIdentity'
                identity: resourceId(InfraResourceGroupName, 'Microsoft.ManagedIdentity/userAssignedIdentities', UserAssignedManagedIdentityName)
              }
            }
          }

Could someone please provide me with a sample or solution on how my bicep code should look like so that it is the same as the connection that I created manually and which is working fine in the portal?

Thanks in advance

Kind Regards

Senne

Answer 1

Hi Eeraerts Senne,

I will try to reproduce your escenarie and test the code, meanwhile I can point the main difference between your Manual configuration and your bicep deployment as you mention is your Authentication. I understood that you want to configure using managed identity so for you 2 main resources on bicep Connections and workflows you need to add Identity section.

Example for Microsoft.Web/connections :

resource sqlConnection 'Microsoft.Web/connections@2018-07-01-preview' = {
  name: 'sqlConnection'
  location: resourceGroup().location
  properties: {
    api: {
      id: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Web/locations/${resourceGroup().location}/managedApis/sql'
    }
    displayName: 'sqlConnection'
    parameterValues: {
      'sqlServer': 'your-server-name'
      'sqlDatabase': 'your-database-name'
    }
  }
 //# Here your identity need to be setup to use user Assigned Managed Identity
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${managedIdentity.id}': {}
    }
  }
}

The same block for example on Microsoft.Logic/workflows

resource logicApp 'Microsoft.Logic/workflows@2019-05-01' = {
  name: 'logicApp'
  location: resourceGroup().location
  properties: {
    definition: {
      '$schema': 'https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#'
      contentVersion: '1.0.0.0'
      actions: {
        // Your Logic App actions here
      }
      triggers: {
        // Your Logic App triggers here
      }
      parameters: {
        '$connections': {
          defaultValue: {
            'sql': {
              connectionId: sqlConnection.id
              connectionName: sqlConnection.name
              id: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Web/locations/${resourceGroup().location}/managedApis/sql'
            }
          }
        }
      }
    }
    parameters: {
      '$connections': {
        value: {
          'sql': {
            connectionId: sqlConnection.id
            connectionName: sqlConnection.name
            id: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Web/locations/${resourceGroup().location}/managedApis/sql'
          }
        }
      }
    }
  }
 //# Here your identity need to be setup to use user Assigned Managed Identity
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${managedIdentity.id}': {}
    }
  }
}

If you share your bicep code (without confidential information) i can reproduce your escenarie and help you better.

Let me know. Luis

Answer 2

Although the solution works for me as well, I still have an issue after a deploy in a clean resource group. When I open the designer it reports "Invalid connection". After I select the user assigned managed identity from the dropdown, a new connection is created in the connections.json file with the same content. Then the designer is happy. I cannot see the difference between the connection which is deployed and the connection which is created using the portal. Did anyone had the same problem and found a way to solve it?