Can I use a service account to create logic app? And then deploy it on test and live environment using a different user account? How will that work? I know for automation, service account must be used. But is it necessary for the account through which we are deploying is same as the one through which the logic app is created? Thanks.

Hi @Fareeha Sattar Shaikh Thank you for posting the question on this forum. If you have an ARM template generated for your Logic App, you can use that to deploy the App on a different environment using a different account and various approaches such as CLI, PowerShell, Visual Studio etc. Please refer to Deploy Azure Resource Manager templates for Azure Logic Apps Here is a reference on how you can Create Logic Apps using ARM templates . If you have an existing resource in the portal, you can export the ARM template for the resource through Azure portal or CLI or PowerShell. Here is a reference for the documentation - Use Azure portal to export a template If you do use this approach to generate the template, please make sure to test this before using it in Production as the template might be missing some password parameters. Hope this helps. Please let us know if you have any further questions. If the response helped, please do click Accept Answer and Yes for the answer provided. Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.

Can the accounts for creation of logic app and deployment of logic app be different?

Accepted answer

LeelaRajeshSayana-MSFT 13,871 Reputation points

2024-05-15T20:32:29.3633333+00:00

Hi @Fareeha Sattar Shaikh Thank you for posting the question on this forum.

If you have an ARM template generated for your Logic App, you can use that to deploy the App on a different environment using a different account and various approaches such as CLI, PowerShell, Visual Studio etc. Please refer to Deploy Azure Resource Manager templates for Azure Logic Apps

Here is a reference on how you can Create Logic Apps using ARM templates. If you have an existing resource in the portal, you can export the ARM template for the resource through Azure portal or CLI or PowerShell. Here is a reference for the documentation - Use Azure portal to export a template If you do use this approach to generate the template, please make sure to test this before using it in Production as the template might be missing some password parameters.

Hope this helps. Please let us know if you have any further questions.

If the response helped, please do click Accept Answer and Yes for the answer provided. Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.
Please sign in to rate this answer.
Fareeha Sattar Shaikh 40 Reputation points

2024-05-16T10:46:41.8033333+00:00

Hi @LeelaRajeshSayana-MSFT

Thank you for your reply. Just for clarification, does the account running the logic app and services has to be the same as the account that deployed those?

Such as the account used for connection between logic app and d365 crm for connector has to be the same as the account that was used for the deployment of the app?

LeelaRajeshSayana-MSFT 13,871 Reputation points

2024-05-16T13:37:20.37+00:00

Hi @Fareeha Sattar Shaikh Thank you for your response

Just for clarification, does the account running the logic app and services has to be the same as the account that deployed those?

When you deploy the Azure Logic App through Azure CLI for example, the CLI uses the Default Azure Credentials account information to deploy the resource. This is the account information which is authenticated to the CLI using az login command.

Such as the account used for connection between logic app and d365 crm for connector has to be the same as the account that was used for the deployment of the app?

This set of credentials does not have to match. You can use different accounts for connectors and use a different account for deployment.

Hope this adds some clarification. If you have any further questions, please do let us know. If the response helped, please do click Accept Answer and Yes for the answer provided as it would help other community members with similar issue identify the solution. Thank you.

Fareeha Sattar Shaikh 40 Reputation points

2024-05-17T11:57:42.01+00:00

Hi @LeelaRajeshSayana-MSFT

Thank you for your response. I do have some following question in regards to access.

The account that is used in connectors/ the account running the logic app, does it necessarily need permission to access everything within that resource group?

Such as if my logic app is using Azure Service Bus trigger of Topic, then does that connector needs to have create/read/delete permissions of the the service bus?

The thing is that I don't want my service account to have too much access or a contributor access. But still I want to be used as a logic app runner and for connectors.

LeelaRajeshSayana-MSFT 13,871 Reputation points

2024-05-22T12:18:25.7066667+00:00

Hi @Fareeha Sattar Shaikh Apologies for the delayed response. When you try to set up a connection with a connector such as Service Bus, it provides option to connect using Access Keys or through Use Microsoft Entra ID. If use the first approach, you do not have to worry about user access. However, this is less secure as anyone can access the resource with App Keys. If you use Microsoft Entra ID on the other hand, you will need to grant access for this user to the Azure service bus.

The thing is that I don't want my service account to have too much access or a contributor access.

You would not need to provide contributor access to all the users in your logic ap workflow. For instance, if you plan to connect to service bus topic/queue to read data, you can assign the user Azure Service Bus Data Receiver role and connect using this user in the logic app connector. Similarly, you can look into other connectors in the workflow to analyze and assign more restrictive roles for users.

Hope this makes senses. Please do click Accept Answer and Yes for the answer, as it might be beneficial to other community members reading this thread. And, if you have any further query do let us know. Thank you
Sign in to comment

Share via

Can the accounts for creation of logic app and deployment of logic app be different?

0 additional answers