az logicapp connection acl

Note

This reference is part of the logicapp extension for the Azure CLI (version 2.67.0 or higher). The extension will automatically install the first time you run an az logicapp connection acl command. Learn more about extensions.

Manage access policies on a managed API connection.

An access policy names the Entra identity allowed to use a managed API connection. A Logic App reaches a managed API connection through its own managed identity, so without a matching policy the connection exists but the app cannot call it. Only V2 connections accept access policies.

Commands

Name	Description	Type	Status
az logicapp connection acl add	Grant an Entra identity access to a managed API connection.	Extension	GA
az logicapp connection acl list	List access policies on a managed API connection.	Extension	GA
az logicapp connection acl remove	Remove an access policy from a managed API connection.	Extension	GA
az logicapp connection acl show	Show one access policy on a managed API connection.	Extension	GA

az logicapp connection acl add

Grant an Entra identity access to a managed API connection.

Takes the object id of the principal, normally the principalId reported by az logicapp identity show. Refuses on V1 connections, which cannot hold access policies and cannot be converted.

az logicapp connection acl add --connection
                               --object-id
                               --resource-group
                               [--acquire-policy-token]
                               [--change-reference]
                               [--location]
                               [--policy]
                               [--tenant-id]

Examples

Grant a Logic App's system-assigned identity access to a connection.

az logicapp connection acl add -g rg-lacli-ri2bg8 --connection blobProd --object-id 00000000-0000-0000-0000-000000000000

Required Parameters

--connection

Managed API connection name. Must be a V2 connection; V1 connections cannot accept access policies.

--object-id

Entra object id (principal id) of the identity being granted access.

--resource-group -g

Resource group containing the connection.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--location -l

Access policy location. Defaults to the connection location.

--policy

Access policy name. Defaults to the object id.

--tenant-id

Tenant of the principal. Defaults to the signed-in tenant.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az logicapp connection acl list

List access policies on a managed API connection.

az logicapp connection acl list --connection
                                --resource-group

Examples

List the identities allowed to use a connection.

az logicapp connection acl list -g rg-lacli-ri2bg8 --connection blobProd

Required Parameters

--connection

Managed API connection name.

--resource-group -g

Resource group containing the connection.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az logicapp connection acl remove

Remove an access policy from a managed API connection.

The principal named by the policy immediately loses access to the connection, so workflows relying on it begin to fail. Prompts unless --yes is given.

az logicapp connection acl remove --connection
                                  --policy
                                  --resource-group
                                  [--acquire-policy-token]
                                  [--change-reference]
                                  [--yes]

Examples

Remove an access policy without prompting.

az logicapp connection acl remove -g rg-lacli-ri2bg8 --connection blobProd --policy la-cli-pilot-ri2bg8-00000000-0000-0000-0000-000000000000 --yes

Required Parameters

--connection

Managed API connection name.

--policy

Access policy name to remove.

--resource-group -g

Resource group containing the connection.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--yes -y

Do not prompt for confirmation.

Property	Value
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az logicapp connection acl show

Show one access policy on a managed API connection.

az logicapp connection acl show --connection
                                --policy
                                --resource-group

Examples

Show a single access policy.

az logicapp connection acl show -g rg-lacli-ri2bg8 --connection blobProd --policy la-cli-pilot-ri2bg8-00000000-0000-0000-0000-000000000000

Required Parameters

--connection

Managed API connection name.

--policy

Access policy name.

--resource-group -g

Resource group containing the connection.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

Feedback

Was this page helpful?