Logic Apps - App Settings for runtime storage using user-assigned managed identity.

Question

Hi,

I want to eliminate the connection string to connect to runtime storage. I implemented the user-assigned managed identity, however, it seems that it is not working after the change. I keep on getting "Microsoft.WindowsAzure.Storage: Value cannot be null. (Parameter 'connectionString')." error after removing the AzureWebJobsStorage. Is anyone encountered this? Is this because of Extension Bundle v1.x not supported the UAMI? I am looking for the official documentation on this but unable to find.

Thanks

Answer 1

Looks like I'm able to fix the issue by implementing below Environment Variables:

Hope this helps.

Thank you

Answer 2

Hi @Philip John Faraon

Thank you for reaching out to Microsoft Q&A.

The issue occurs because Azure Functions always require a runtime (host) storage account, which is configured using the AzureWebJobsStorage setting. This storage account is used internally by the Functions runtime for operations such as trigger management, scaling, checkpoints, and logging. When AzureWebJobsStorage is completely removed, the runtime still attempts to resolve it and expects either a connection string or an identity-based configuration. Since neither is present, the runtime fails during startup and throws the error “Value cannot be null. (Parameter ‘connectionString’)”. This behavior is expected and is not related to Extension Bundle v1.x limitations. Managed Identity (including User-Assigned Managed Identity) is supported for runtime storage, but the setting itself cannot be deleted—only converted from a connection-string-based configuration to an identity-based one.

Refer below points to resolve this issue or use this as a workaround:

1. Do not delete AzureWebJobsStorage; convert it to identity-based configuration

The AzureWebJobsStorage setting must still exist. Instead of a connection string, configure it to use Managed Identity by splitting it into identity-based app settings.

AzureWebJobsStorage__accountName = <storage-account-name>AzureWebJobsStorage__credential = managedidentityAzureWebJobsStorage__clientId = <user-assigned-managed-identity-client-id>Show more lines

This tells the Azure Functions runtime to authenticate to the storage account using the User-Assigned Managed Identity instead of a connection string.

2. Assign required RBAC roles to the User-Assigned Managed Identity

Ensure that the same User-Assigned Managed Identity configured above has the required permissions on the storage account used for runtime storage. At minimum, assign:

Storage Blob Data Owner

Storage Queue Data Contributor

These roles are required for the Functions runtime to manage internal containers, queues, and scale-related metadata.

3. Extension Bundle version is not the root cause

Extension Bundle v1.x does not block the use of Managed Identity for AzureWebJobsStorage. The error occurs before extensions are loaded and is purely due to missing or incomplete runtime storage configuration. Once AzureWebJobsStorage__credential=managedidentity (and __clientId for UAMI) is added, the runtime initializes successfully regardless of the extension bundle version.

Answer 3

To eliminate the connection string for runtime storage in Azure Logic Apps using a user-assigned managed identity (UAMI), you need to ensure that the app settings are correctly configured. If you are encountering the error "Microsoft.WindowsAzure.Storage: Value cannot be null. (Parameter 'connectionString')" after removing the AzureWebJobsStorage setting, it indicates that the Logic App is still expecting a connection string.

Here are the steps to troubleshoot and ensure proper configuration:

1. Check App Settings: Make sure that you have added the necessary app settings for the user-assigned managed identity. You should include settings like AzureWebJobsStorage__managedIdentityResourceId, AzureWebJobsStorage__blobServiceUri, and others as specified in the documentation.
2. Remove Old Connection String: Ensure that the AzureWebJobsStorage connection string is completely removed from the app settings, as having it can cause conflicts.
3. Role Assignment: Verify that the user-assigned managed identity has the correct role assignments on the storage account. It should have at least the Storage Blob Data Contributor role to access the storage resources.
4. Extension Bundle Compatibility: If you are using Extension Bundle v1.x, it is important to note that it may not support UAMI. You might want to consider upgrading to a later version that supports user-assigned managed identities.
5. Documentation Reference: For further details on setting up managed identity access in Logic Apps, you can refer to the official documentation.

If the issue persists, consider reviewing the Azure portal logs for more detailed error messages that could provide additional insights into the problem.