Blog Post

Azure Integration Services Blog
2 MIN READ

📢 Announcement !! Azure Logic Apps Standard RBAC Roles in Public Preview

WSilveira's avatar
WSilveira
Icon for Microsoft rankMicrosoft
Aug 23, 2023

The Logic Apps team rolled out a series of RBAC roles for Logic Apps Standard, which provides more granular permissions for operations under Azure Logic Apps Standard. You will find that the following roles are now available:

 

  • Logic App Standard Reader (Preview): Provide you with view only access to all resources within a Logic App Standard application, including workflow history and workflow run.

  • Logic App Standard Operator (Preview): Let you access a Logic App Standard application and all workflows, allowing you to resubmit/enable/disable workflow, as well as configuring api connections and network. Operators can administer the platform and execute support tasks, but do not have permissions to make changes on workflow or app settings.

  • Logic App Standard Developer (Preview): Let you create and update workflows, API Connections and app settings in a Logic App standard application. The developer role does not allow you to make changes outside the scope of workflows - so application-wide changes like VNET configuration, App Service Plans are not supported.

  • Logic App Standard Contributor (Preview): Let you manage all aspects of a Logic App Standard application, but you can't change access to them.

The table below summarized the capabilities of each one of the roles:

 

Permission Reader Operator Developer

Contributor

Read workflow

Read Runs

Read site config

Restart/Stop/Start site
Trigger/resubmit runs
Read Schemas/Maps
Read parameters
Read/write app settings
Enable debug mode (app setting)

Update workflows

(Portal and VSCode)

Access Kudu
Make/update connections
All other config
Add/remove roles

 

You can follow those steps to apply RBAC roles to your Logic Apps Standard.

Updated Aug 22, 2023
Version 1.0
  • waynepyrah That is by design. The global contributor role is what you'd need to give a user the ability to create resources in a subscription. These roles are designed to be able to apply to individual Logic Apps to allow users different levels of access within those existing resources.

  • ruben_aster's avatar
    ruben_aster
    Copper Contributor

    Great to finally see some roles dedicated to Standard Logic Apps.

     

    I have two questions:

     

    1. The Operator role contains "Microsoft.Web/sites/write" permission. Is this really needed?

    2. Which exact permissions give "Read parameters" and which give "Read Schemas/Maps"?

  • waynepyrah's avatar
    waynepyrah
    Copper Contributor

    Should the Logic App Standard Contributor (Preview) role allow the creation of logic apps in a resource group (only this role allocated) if the role is set at the resource group level?