Logic App Managed Identity Access to Host Storage Account

[RogierVersteeg]

Hello,

Due to a new policy in our company we are trying to disable storage account access (SAS) keys and replace where possible with RBAC access. In logic app, the host storage account we used has now been modified to disable key acess. We tried replacing in the logic app environement the configuration parameter "AzureWebJobsStorage" with "AzureWebJobsStorage__accountName", and then authorizing via RBAC the logic app system identity on the host storage account but without success. We are basically following this guide: "https://learn.microsoft.com/en-us/azure/azure-functions/functions-identity-based-connections-tutorial#use-managed-identity-for-azurewebjobsstorage" but it is intended for function apps and not logic apps. Changing the configuration parameter "AzureWebJobsStorage" to "AzureWebJobsStorage__accountName" results in the following functions runtime error in our logic app:

 Microsoft.WindowsAzure.Storage: Value cannot be null. (Parameter 'connectionString')

Could you confirm "AzureWebJobsStorage__accountName" that is intended to works for function apps should also works with logic apps?

[BigRollTide]

I am also running into the same issue. Configured AzureWebJobsStorage__accountname, AzureWebJobsStorage__credential (as "managedidentity"), AzureWebJobsStorage__blobServiceUri, and AzureWebJobsStorage__fileServiceUri and got the same error. I also added AzureWebJobsStorage__queueServiceUri and AzureWebJobsStorage__tableServiceUri to see if that would help, but it did not clear the error.

[carlabarintos]

Did this and Logic App didn't run also saying Function Host not running. Any suggestions?

[gtowsey]

this still appears to be an issue, has anyone found a workaround or are they accepting SAS use?

[snshivakumar]

The doc to migrate to managed identity for Logic Apps is here -- please note that for now, only user-assigned managed-identity is supported!

[hristozkov69]

The doc to migrate to managed identity for Logic Apps is here -- please note that for now, only user-assigned managed-identity is supported!

Hey, the page with the doc returns Error 500 after I authenticate with an Azure account, how to open the doc?

[sven5]

@hristozkov69
Just use this link https://learn.microsoft.com/en-us/azure/logic-apps/create-single-tenant-workflows-azure-portal?branch=main&branchFallbackFrom=pr-en-us-279972#set-up-managed-identity-access-to-your-storage-account