Logic App Standard – Connections require manual re-authorization after deployment via pipeline

Question

Logic App Standard – Connections require manual re-authorization after deployment via pipeline

Keerthi Malini S 0

I am following the below Microsoft documentation for deploying Azure Logic App Standard workflows using CI/CD:

https://learn.microsoft.com/en-us/azure/logic-apps/automate-build-deployment-standard

I have successfully set up a deployment pipeline and am deploying the following components:

Workflows

Parameters

Connections (via ARM/Bicep/JSON templates)

The deployment completes successfully, and all resources (including API connections) are created.

Issue:

After deployment, the connections appear in the Logic App but are in an unauthenticated state. Specifically:

Connections show status like “Access Policies are missing”
Managed Identity is not automatically assigned/authorized
I must manually:
1. Open each connection
2. Assign the Logic App’s managed identity
3. Re-authorize the connection

Only after this manual step do the workflows function correctly.

Is there a way to:

Automatically assign the Logic App’s managed identity to API connections during deployment?

Fully authorize connections via pipeline without manual steps?

Avoid post-deployment manual re-authorization?

This behavior impacts CI/CD automation since manual intervention is required after each deployment.

Any guidance or best practices to fully automate connection authorization would be greatly appreciated.

Thank you!

Rakesh Mishra 7,215 Reputation points Microsoft External Staff Moderator

2026-04-07T20:02:33.3633333+00:00

Hi Keerthi, following up to see if you had a chance to check my previous response and if it was helpful. Please do let me know if you're still facing the issue and need any further assistance on this.

1 answer

Your answer

Rakesh Mishra 7,215 Reputation points Microsoft External Staff Moderator

2026-04-07T20:02:33.3633333+00:00

Hi Keerthi, following up to see if you had a chance to check my previous response and if it was helpful. Please do let me know if you're still facing the issue and need any further assistance on this.

Answer 1

Hi Keerthi,

To fully automate the connection authorization in a Logic App Standard CI/CD pipeline, you need to explicitly create an Access Policy resource that grants your Logic App’s System-Assigned Managed Identity access to the API Connection.

When this access policy is omitted from your ARM/Bicep templates, the API connection successfully deploys but remains unauthenticated, displaying the “Access Policies are missing” warning in the portal.

You can automate this using one of the following methods:

Method 1: Automating via Bicep/ARM (Recommended)

Instead of relying on manual portal clicks, add the access policy as a child resource (Microsoft.Web/connections/accessPolicies) to your Bicep/ARM template during deployment.

Here is the correct Bicep snippet:

// 1. Reference your existing Logic App to fetch its Identity
resource logicApp 'Microsoft.Web/sites@2022-09-01' existing = {
  name: logicAppName
}
// 2. Create the API Connection
resource myConn 'Microsoft.Web/connections@2016-06-01' = {
  name: connectionName
  location: resourceGroup().location
  properties: {
    // Your connection specific parameters here
  }
}
// 3. Create the Access Policy linking the Identity to the Connection
resource accessPolicy 'Microsoft.Web/connections/accessPolicies@2016-06-01' = {
  name: '${myConn.name}/${logicApp.name}' // The name must follow the pattern: ConnectionName/LogicAppName
  location: resourceGroup().location
  properties: {
    principal: {
      type: 'ActiveDirectory'
      identity: {
        tenantId: subscription().tenantId
        objectId: logicApp.identity.principalId
      }
    }
  }
}

Method 2: Azure CLI via DevOps Pipeline Task

If you prefer to authorize the connections using an inline script after the deployment job completes, you can use az resource create to explicitly create the child resource:

# Get the Logic App Managed Identity Principal ID
principalId=$(az resource show \
  --resource-group $RG \
  --resource-type Microsoft.Web/sites \
  --name $LOGIC_APP_NAME \
  --query identity.principalId -o tsv)
# Get your Tenant ID
tenantId=$(az account show --query tenantId -o tsv)
# Create the Access Policy child resource
az resource create \
  --id "/subscriptions/$SUB/resourceGroups/$RG/providers/Microsoft.Web/connections/$CONN_NAME/accessPolicies/$LOGIC_APP_NAME" \
  --api-version "2016-06-01" \
  --properties "{\"principal\": {\"type\": \"ActiveDirectory\", \"identity\": {\"tenantId\": \"$tenantId\", \"objectId\": \"$principalId\"}}}"

Crucial detail for your Zip Deploy: In addition to deploying the infrastructure access policies, ensure that the connections.json file inside your compiled workflow Zip Artifact configures the managed connections to use the identity. The authentication block should look like this:

"authentication": {
  "type": "ManagedServiceIdentity"
}

Once you incorporate this child resource into your IaC pipeline and ensure your connections.json reflects Managed Identity auth, your connections will automatically be authorized post-deployment.

Let me know if you run into any issues adapting this to your specific connectors! Note: This response is drafted with the help of AI systems.

Share via

Logic App Standard – Connections require manual re-authorization after deployment via pipeline

1 answer

Your answer