How to give an Azure Managed Identity access to Azure REST API (management.azure.com) to query Logic App actions?

Question

I want to allow an Azure Function to use a Managed Identity to query the Azure REST API. I am specifically interested in Standard Logic App action results and am using a query like this:

https://management.azure.com/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.Web/sites/{standard_logic_app}/hostruntime/runtime/webhooks/workflow/api/management/workflows/{workflow}/runs/{run_id}/actions?api-version={api_version}&$filter=Status eq 'Failed'

It works fine when I use my own user's credentials. But I can't find anywhere to provide this access level to a Managed Identity. I gave the query a shot via Postman and can get a token for the Managed Identity, but the query fails with permission errors (...does not have authorization to perform action 'Microsoft.Web/sites/hostruntime/webhooks/api/workflows/runs/actions/read'...).

Does anyone know where this permission can be set?

Answer 1

I did not realise the access assignment is done against the resource you want to provide access to (in this case, a Logic App)!