Skip to content

Commit dd700b9

Browse files
v-albemiv-albemi
authored
Merge pull request #88251 from ecfan/user-assigned-identity
Formatting prep
2 parents 99df92d + c1f7e8f commit dd700b9

File tree

1 file changed

+45
-105
lines changed

1 file changed

+45
-105
lines changed

‎articles/logic-apps/create-managed-service-identity.md

Lines changed: 45 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
2-
title: Authenticate with managed identities - Azure Logic Apps | Microsoft Docs
2+
title: Authenticate with managed identities - Azure Logic Apps
33
description: To authenticate without signing in, you can create a managed identity (formerly called Managed Service Identity or MSI) so your logic app can access resources in other Azure Active Directory (Azure AD) tenants without credentials or secrets
4-
author: kevinlam1
5-
ms.author: klam
6-
ms.reviewer: estfan, LADocs
4+
author: ecfan
5+
ms.author: estfan
6+
ms.reviewer: klam, LADocs
77
services: logic-apps
88
ms.service: logic-apps
99
ms.suite: integration
@@ -13,39 +13,26 @@ ms.date: 03/29/2019
1313

1414
# Authenticate and access resources with managed identities in Azure Logic Apps
1515

16-
To access resources in other Azure Active Directory (Azure AD) tenants and
17-
authenticate your identity without signing in, your logic app can use a
18-
[managed identity](../active-directory/managed-identities-azure-resources/overview.md)
19-
(formerly known as Managed Service Identity or MSI), rather than credentials or secrets.
20-
Azure manages this identity for you and helps secure your credentials because you don't
21-
have to provide or rotate secrets. This article shows how you can set up and use a
22-
system-assigned managed identity for your logic app. For more information about managed identities,
23-
see [What is managed identities for Azure resources?](../active-directory/managed-identities-azure-resources/overview.md)
16+
To access resources in other Azure Active Directory (Azure AD) tenants and authenticate your identity without signing in, your logic app can use a [managed identity](../active-directory/managed-identities-azure-resources/overview.md) (formerly known as Managed Service Identity or MSI), rather than credentials or secrets. Azure manages this identity for you and helps secure your credentials because you don't have to provide or rotate secrets. This article shows how you can set up and use a system-assigned managed identity for your logic app. For more information about managed identities, see [What is managed identities for Azure resources?](../active-directory/managed-identities-azure-resources/overview.md)
2417

2518
> [!NOTE]
26-
> Your logic app can use managed identities only with
27-
> connectors that support managed identities. Currently,
19+
> Your logic app can use managed identities only with connectors that support managed identities. Currently,
2820
> only the HTTP connector supports managed identities.
2921
>
30-
> You can currently have up to 10 logic app workflows with
31-
> system-assigned managed identities in each Azure subscription.
22+
> You can currently have up to 10 logic app workflows with system-assigned managed identities in each Azure subscription.
3223
3324
## Prerequisites
3425

35-
* An Azure subscription, or if you don't have a subscription,
36-
<a href="https://azure.microsoft.com/free/" target="_blank">sign up for a free Azure account</a>.
26+
* An Azure subscription, or if you don't have a subscription, [sign up for a free Azure account](https://azure.microsoft.com/free/).
3727

38-
* The logic app where you want to use the system-assigned
39-
managed identity. If you don't have a logic app, see
28+
* The logic app where you want to use the system-assigned managed identity. If you don't have a logic app, see
4029
[Create your first logic app workflow](../logic-apps/quickstart-create-first-logic-app-workflow.md).
4130

4231
<a name="enable-identity"></a>
4332

4433
## Enable managed identity
4534

46-
For system-assigned managed identities, you don't have to manually create that identity.
47-
To set up a system-assigned managed identity for your logic app,
48-
you can use these ways:
35+
For system-assigned managed identities, you don't have to manually create that identity. To set up a system-assigned managed identity for your logic app, you can use these ways:
4936

5037
* [Azure portal](#azure-portal)
5138
* [Azure Resource Manager templates](#template)
@@ -55,41 +42,30 @@ you can use these ways:
5542

5643
### Azure portal
5744

58-
To enable a system-assigned managed identity for your logic app through
59-
the Azure portal, turn on the **System assigned** setting in your logic
60-
app's identity settings.
45+
To enable a system-assigned managed identity for your logic app through the Azure portal, turn on the **System assigned** setting in your logic app's identity settings.
6146

62-
1. In the [Azure portal](https://portal.azure.com),
63-
open your logic app in Logic App Designer.
47+
1. In the [Azure portal](https://portal.azure.com), open your logic app in Logic App Designer.
6448

65-
1. On the logic app menu, under **Settings**, select **Identity**.
49+
1. On the logic app menu, under **Settings**, select **Identity**.
6650

67-
1. Under **System assigned** > **Status**, choose **On**.
68-
Then, choose **Save** > **Yes**.
51+
1. Under **System assigned** > **Status**, select **On**. Then, select **Save** > **Yes**.
6952

7053
![Turn on managed identity setting](./media/create-managed-service-identity/turn-on-managed-service-identity.png)
7154

72-
Your logic app now has a system-assigned managed identity registered
73-
in Azure Active Directory:
55+
Your logic app now has a system-assigned managed identity registered in Azure Active Directory:
7456

7557
![GUIDs for object ID](./media/create-managed-service-identity/object-id.png)
7658

77-
| Property | Value | Description |
78-
|----------|-------|-------------|
79-
| **Object ID** | <*identity-resource-ID*> | A Globally Unique Identifier (GUID) that represents the system-assigned managed identity for your logic app in an Azure AD tenant |
80-
|||
59+
| Property | Value | Description |
60+
|----------|-------|-------------|
61+
| **Object ID** | <*identity-resource-ID*> | A Globally Unique Identifier (GUID) that represents the system-assigned managed identity for your logic app in an Azure AD tenant |
62+
||||
8163

8264
<a name="template"></a>
8365

8466
### Azure Resource Manager template
8567

86-
When you want to automate creating and deploying
87-
Azure resources such as logic apps, you can use
88-
[Azure Resource Manager templates](../logic-apps/logic-apps-azure-resource-manager-templates-overview.md).
89-
To create a system-assigned managed identity for
90-
your logic app through a template, add the `"identity"`
91-
element and `"type"` property to your logic app workflow
92-
definition in your deployment template:
68+
When you want to automate creating and deploying Azure resources such as logic apps, you can use [Azure Resource Manager templates](../logic-apps/logic-apps-azure-resource-manager-templates-overview.md). To create a system-assigned managed identity for your logic app through a template, add the `"identity"` element and `"type"` property to your logic app workflow definition in your deployment template:
9369

9470
```json
9571
"identity": {
@@ -122,8 +98,7 @@ For example:
12298
}
12399
```
124100

125-
When Azure creates your logic app, that logic app's
126-
workflow definition includes these additional properties:
101+
When Azure creates your logic app, that logic app's workflow definition includes these additional properties:
127102

128103
```json
129104
"identity": {
@@ -133,78 +108,57 @@ workflow definition includes these additional properties:
133108
}
134109
```
135110

136-
| Property | Value | Description |
111+
| Property | Value | Description |
137112
|----------|-------|-------------|
138-
| **principalId** | <*principal-ID*> | A Globally Unique Identifier (GUID) that represents the logic app in the Azure AD tenant and sometimes appears as an "object ID" or `objectID` |
139-
| **tenantId** | <*Azure-AD-tenant-ID*> | A Globally Unique Identifier (GUID) that represents the Azure AD tenant where the logic app is now a member. Inside the Azure AD tenant, the service principal has the same name as the logic app instance. |
140-
|||
113+
| **principalId** | <*principal-ID*> | A Globally Unique Identifier (GUID) that represents the logic app in the Azure AD tenant and sometimes appears as an "object ID" or `objectID` |
114+
| **tenantId** | <*Azure-AD-tenant-ID*> | A Globally Unique Identifier (GUID) that represents the Azure AD tenant where the logic app is now a member. Inside the Azure AD tenant, the service principal has the same name as the logic app instance. |
115+
||||
141116

142117
<a name="access-other-resources"></a>
143118

144119
## Access resources with managed identity
145120

146-
After you create a system-assigned managed identity for your logic app,
147-
you can [give that identity access to other Azure resources](../active-directory/managed-identities-azure-resources/howto-assign-access-portal.md).
148-
You can then use that identity for authentication, just like any other
149-
[service principal](../active-directory/develop/app-objects-and-service-principals.md).
121+
After you create a system-assigned managed identity for your logic app, you can [give that identity access to other Azure resources](../active-directory/managed-identities-azure-resources/howto-assign-access-portal.md). You can then use that identity for authentication, just like any other [service principal](../active-directory/develop/app-objects-and-service-principals.md).
150122

151123
> [!NOTE]
152124
> Both the system-assigned managed identity and the resource where
153125
> you want to assign access must have the same Azure subscription.
154126

155127
### Assign access to managed identity
156128

157-
To give access to another Azure resource for your logic
158-
app's system-assigned managed identity, follow these steps:
129+
To give access to another Azure resource for your logic app's system-assigned managed identity, follow these steps:
159130

160-
1. In the Azure portal, go to the Azure resource where
161-
you want to assign access for your managed identity.
131+
1. In the Azure portal, go to the Azure resource where you want to assign access for your managed identity.
162132

163-
1. From the resource's menu, select **Access control (IAM)**.
164-
On the toolbar, choose **Add** > **Add role assignment**.
133+
1. From the resource's menu, select **Access control (IAM)**. On the toolbar, choose **Add** > **Add role assignment**.
165134

166135
![Add role assignment](./media/create-managed-service-identity/add-permissions-logic-app.png)
167136

168-
1. Under **Add role assignment**, select the **Role** you want for the identity.
137+
1. Under **Add role assignment**, select the **Role** you want for the identity.
169138

170-
1. In the **Assign access to** property,
171-
select **Azure AD user, group, or service principal**,
172-
if not already selected.
139+
1. In the **Assign access to** property, select **Azure AD user, group, or service principal**, if not already selected.
173140

174-
1. In the **Select** box, starting with the first character
175-
in your logic app's name, enter your logic app's name.
176-
When your logic app appears, select the logic app.
141+
1. In the **Select** box, starting with the first character in your logic app's name, enter your logic app's name. When your logic app appears, select the logic app.
177142

178143
![Select logic app with managed identity](./media/create-managed-service-identity/add-permissions-select-logic-app.png)
179144

180145
1. When you're done, choose **Save**.
181146

182147
### Authenticate with managed identity in logic app
183148

184-
After you set up your logic app with a system-assigned managed identity
185-
and assigned access to the resource you want for that identity,
186-
you can now use that identity for authentication. For example,
187-
you can use an HTTP action so your logic app can send an HTTP
188-
request or call to that resource.
149+
After you set up your logic app with a system-assigned managed identity and assigned access to the resource you want for that identity, you can now use that identity for authentication. For example, you can use an HTTP action so your logic app can send an HTTP request or call to that resource.
189150

190151
1. In your logic app, add the **HTTP** action.
191152

192-
1. Provide the necessary details for that action,
193-
such as the request **Method** and **URI** location
194-
for the resource you want to call.
153+
1. Provide the necessary details for that action, such as the request **Method** and **URI** location for the resource you want to call.
195154

196-
For example, suppose you're using Azure Active
197-
Directory (Azure AD) authentication with
198-
[one of these Azure services that support Azure AD](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication).
199-
In the **URI** box, enter the endpoint URL for that Azure service.
200-
So, if you're using Azure Resource Manager, enter this value in the **URI** property:
155+
For example, suppose you're using Azure Active Directory (Azure AD) authentication with [one of these Azure services that support Azure AD](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication). In the **URI** box, enter the endpoint URL for that Azure service. So, if you're using Azure Resource Manager, enter this value in the **URI** property:
201156

202157
`https://management.azure.com/subscriptions/<Azure-subscription-ID>?api-version=2016-06-01`
203158

204159
1. In the HTTP action, choose **Show advanced options**.
205160

206-
1. From the **Authentication** list, select **Managed Identity**.
207-
After you select this authentication, the **Audience** property
161+
1. From the **Authentication** list, select **Managed Identity**. After you select this authentication, the **Audience** property
208162
appears with the default resource ID value:
209163

210164
![Select "Managed Identity"](./media/create-managed-service-identity/select-managed-service-identity.png)
@@ -224,46 +178,32 @@ appears with the default resource ID value:
224178

225179
## Remove managed identity
226180

227-
To disable a system-assigned managed identity on your logic app,
228-
you can follow the steps similar to how you set up the identity
229-
through the Azure portal, Azure Resource Manager deployment templates,
230-
or Azure PowerShell.
181+
To disable a system-assigned managed identity on your logic app, you can follow the steps similar to how you set up the identity through the Azure portal, Azure Resource Manager deployment templates, or Azure PowerShell.
231182

232-
When you delete your logic app,
233-
Azure automatically removes your logic app's
234-
system-assigned identity from Azure AD.
183+
When you delete your logic app, Azure automatically removes your logic app's system-assigned identity from Azure AD.
235184

236185
### Azure portal
237186

238-
To remove a system-assigned managed identity for your logic app
239-
through the Azure portal, turn off the **System assigned** setting
240-
in your logic app's identity settings.
187+
To remove a system-assigned managed identity for your logic app through the Azure portal, turn off the **System assigned** setting in your logic app's identity settings.
241188

242-
1. In the [Azure portal](https://portal.azure.com),
243-
open your logic app in Logic App Designer.
189+
1. In the [Azure portal](https://portal.azure.com), open your logic app in Logic App Designer.
244190

245-
1. On the logic app menu, under **Settings**, select **Identity**.
191+
1. On the logic app menu, under **Settings**, select **Identity**.
246192

247-
1. Under **System assigned** > **Status**, choose **Off**.
248-
Then, choose **Save** > **Yes**.
193+
1. Under **System assigned** > **Status**, choose **Off**. Then, choose **Save** > **Yes**.
249194

250195
![Turn off managed identity setting](./media/create-managed-service-identity/turn-off-managed-service-identity.png)
251196

252197
### Deployment template
253198

254-
If you created the logic app's system-assigned managed identity
255-
with an Azure Resource Manager deployment template, set the
256-
`"identity"` element's `"type"` property to `"None"`.
257-
This action also deletes the principal ID from Azure AD.
199+
If you created the logic app's system-assigned managed identity with an Azure Resource Manager deployment template, set the `"identity"` element's `"type"` property to `"None"`. This action also deletes the principal ID from Azure AD.
258200

259201
```json
260202
"identity": {
261203
"type": "None"
262204
}
263205
```
264206

265-
## Get support
207+
## Next steps
266208

267-
* For questions, visit the [Azure Logic Apps forum](https://social.msdn.microsoft.com/Forums/en-US/home?forum=azurelogicapps).
268-
* To submit or vote on feature ideas, visit the
269-
[Logic Apps user feedback site](https://aka.ms/logicapps-wish).
209+
* [Secure access and data in Azure Logic Apps](../logic-apps/logic-apps-securing-a-logic-app.md)

0 commit comments

Comments
 (0)