az logicapp connection managed

Note

This reference is part of the logicapp extension for the Azure CLI (version 2.67.0 or higher). The extension will automatically install the first time you run an az logicapp connection managed command. Learn more about extensions.

Create Azure managed API connections for local projects or deployed Standard sites.

Commands

Name	Description	Type	Status
az logicapp connection managed create	Create an Azure managed API connection and wire a local project or deployed app.	Extension	GA

az logicapp connection managed create

Create an Azure managed API connection and wire a local project or deployed app.

--name always names the connection. Choose --path or a local --context for local development; --logic-app-name or a cloud --context selects a deployed app. With no explicit target the active context is used. Local Azure scope comes from local.settings.json Values.WORKFLOWS_SUBSCRIPTION_ID, WORKFLOWS_RESOURCE_GROUP_NAME and WORKFLOWS_LOCATION_NAME; explicit --subscription, --resource-group and --location override those values without changing settings or the default account. Azure login is still required. Local projects use a seven-day development connection key stored only in local.settings.json and referenced from connections.json. No deployed app, managed identity or access-policy write is needed. Local auth-mode managed-identity and user-assigned identities are unsupported; raw, service-principal and oauth configure the connector's backend authentication, independently of the local runtime key. Local settings must be unencrypted and not tracked by Git; .gitignore protection is added. Force is required for existing Azure resources, local wiring or the key setting. Failures may retain Azure resources and partially updated local files; inspect before retrying. Deployed targets retain the guarded managed API/OAuth/identity creation of legacy connection create --managed-api. That legacy mode is deprecated but retains its original --name meaning throughout this preview; removal requires an announced breaking change and it remains deployed-only. OAuth failures may retain connection/access-policy resources. Inspect the reported state before retrying; timeout does not promise resource removal.

az logicapp connection managed create --auth-mode {managed-identity, oauth, raw, service-principal}
                                      --connector
                                      --name
                                      [--acquire-policy-token]
                                      [--change-reference]
                                      [--consent-timeout]
                                      [--context]
                                      [--display-name]
                                      [--force]
                                      [--location]
                                      [--logic-app-name]
                                      [--no-browser]
                                      [--parameter]
                                      [--parameter-set]
                                      [--path]
                                      [--resource-group]
                                      [--secret-parameter]
                                      [--user-assigned-identity]

Examples

Create an Azure Blob connection for the site's managed identity.

az logicapp connection managed create -g my-rg --logic-app-name my-app -n blobProd --connector azureblob -l eastus --auth-mode managed-identity

Create an Office 365 connection with browser consent.

az logicapp connection managed create -g my-rg --logic-app-name my-app -n outlook --connector office365 -l eastus --auth-mode oauth

Create a connection for a local project using its Azure settings.

az logicapp connection managed create --path .\orders -n outlook --connector office365 --auth-mode oauth

Override Azure scope for a saved local project without changing its settings.

az logicapp connection managed create --context orders-local -n outlook --connector office365 --auth-mode oauth --subscription 11111111-1111-1111-1111-111111111111 -g dev-rg -l eastus

Required Parameters

--auth-mode

Connector backend authentication. Local projects support raw, service-principal or oauth; runtime-to-connection authentication uses a separate development key.

Property	Value
Accepted values:	managed-identity, oauth, raw, service-principal

--connector

Managed API connector name or ARM managedApis id.

--name -n

Managed API connection name.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--consent-timeout

OAuth consent timeout in seconds, default 300. On failure resources may be retained; inspect before retrying.

--context

Saved local project or deployed app. Defaults to the active context when no explicit target is supplied.

--display-name

Display name. Defaults to --name.

--force

Replace existing managed connection wiring with revision and ownership checks.

Property	Value
Default value:	False

--location -l

Azure connection location. Required for a deployed target; overrides local WORKFLOWS_LOCATION_NAME.

--logic-app-name

Deployed Logic App Standard site. Alternatively select a local --path or local/cloud --context.

--no-browser

Print the OAuth consent URL instead of opening a browser. Loopback callback still required.

Property	Value
Default value:	False

--parameter

Non-secret NAME=VALUE connection parameter, repeatable.

--parameter-set

Connector parameter set name.

--path

Existing local project to wire. Azure scope comes from command overrides or local.settings.json, not context metadata.

--resource-group -g

Azure resource group for the connection. Required for a deployed target; overrides local WORKFLOWS_RESOURCE_GROUP_NAME.

--secret-parameter

Secret parameter name. The value is read from standard input, never the command line.

--user-assigned-identity

Resource id of an identity already assigned to the app. Defaults to the system identity.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

Feedback

Was this page helpful?