Configuring Access Controls in Azure Logic App

Question

How can I establish access controls within a Logic App on Azure to enable triggering exclusively by members of a specified user group? I aim to configure the Logic App in a way that restricts its activation solely to authorized individuals belonging to this particular group. What procedures and settings are necessary to implement this access restriction effectively?

Answer 1

Hi Ahwan Mishra,

In Azure managing authorizations it's by role assignments(https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal?tabs=delegate-condition), so In your case in order to only trigger logic app (Microsoft.Logic/workflows/runs/write) by an specific group you can assign role access in this way:

• GroupOnlyRead => Logic App Operator
• GroupTrigger => Logic App Contributor

How to Assign the roles: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal?tabs=delegate-condition

https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal#consumption-workflows

An important point in this setup it's the dependency on your current RBAC implementation. That's meaning your user must have the least privileged inherid resource on top level Otherwise if you have more priviledged roles these users will also able to trigger the logic apps workflows already included in the allowed operations (Microsoft.Logic/workflows/runs/write). Let me know if you have any question in your configuration.

Luis