CODEWITHSUNDEEP
azureazure-logic-appsazure-service-principal
jfeldzy
jfeldzy

Reputation: 92

What service principal is used to authenticate Logic Apps to Azure resources

This question is a bit more academic than practical, but I'm just trying to enhance my knowledge of how Azure authentication works under the hood.

The default way to authenticate managed Logic Apps connections is through an OAuth popup asking you to grant permissions. Based on my reading of the Azure docs, this means that you're granting access to the delegated permissions of a service principal. For connectors that access the Graph API, such a service principal in your tenant with the correct delegated permissions:

enter image description here

However, I'm struggling to find an equivalent service principal for connectors that use the Azure Resource Management API to interact with services like Log Analytics, sentinel, Logic Apps, etc. I do see a service principal called Azure Logic Apps, but it doesn't have any permissions associated with it. My understanding is that it would need to have the delegated permission user_impersonation to access Azure resources:

enter image description here

So my questions here are

Upvotes: 0

Views: 50

Answers (1)

wenbo
wenbo

Reputation: 1506

I'll just say what I know. Azure Logic App in Microsoft Entra ID not be related to logic app workflow here.

Microsoft instantiated some sp in Enterprise application, some act as client and some act as resource. Azure Logic App in Enterprise application has the same mechanisms as Microsoft Graph, objectId = 3b78856dd-xxx, act as the resource be invoked by client not the client self (but I not found some examples here.). The client has two types of permissions, self-permission and delegate permision.

In the usual scenario, logicapp sp(or managed identity) used by request is sent using self-permission, which requires you to add the sp corresponding subscription permissions to access the azure resource.

Upvotes: 0

Related Questions