1) Prerequisite
- An Azure account and subscription
- Permissions :
Consumption workflows
Role Description
You can manage logic app workflows, but you can't change access to
Logic App Contributor
them.
You can read, enable, and disable logic app workflows, but you can't
Logic App Operator
edit or update them.
You have full access to manage all resources, but you can't assign roles
Contributor in Azure RBAC, manage assignments in Azure Blueprints, or share
image galleries.
Standard workflows
Role Description
Logic Apps Standard Reader You have read-only access to all resources in a Standard logic app and
(Preview) workflows, including the workflow runs and their history.
You have access to enable, resubmit, and disable workflows and to
create connections to services, systems, and networks for a Standard
Logic Apps Standard
logic app. The Operator role can perform administration and support
Operator (Preview)
tasks on the Azure Logic Apps platform, but doesn't have permissions
to edit workflows or settings.
You have access to create and edit workflows, connections, and
settings for a Standard logic app. The Developer role doesn't have
Logic Apps Standard
permissions to make changes outside the scope of workflows, for
Developer (Preview)
example, application-wide changes such as configure virtual network
integration. App Service Plans aren't supported.
Logic Apps Standard You have access to manage all aspects of a Standard logic app, but you
Contributor (Preview) can't change access or ownership.
Source: https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app?
tabs=azure-portal#access-to-logic-app-operations
2) Authenticate your logic app connector on Azure
services/Resources with system-assigned identity.
https://learn.microsoft.com/en-us/azure/logic-apps/authenticate-with-managed-identity?
tabs=consumption#enable-system-assigned-identity-in-the-azure-portal
3) Authenticate your logic app connector on Azure
services/Resources with user-assigned identity.
https://learn.microsoft.com/en-us/azure/logic-apps/authenticate-with-managed-identity?
tabs=consumption#create-user-assigned-identity-in-the-azure-portal
4) Prerequisite to assign user assigned identity to your logic app
- RBAC role : Managed Identity Operator on the resource group to the Analyst
