Managed Identity — Authenticate Without Secrets

What is Managed Identity?

Managed Identity is an Azure Active Directory feature that provides Azure services with an automatically managed identity. It eliminates the need to store credentials in code, configuration, or key vaults.

There are two types:

• System-assigned — tied to a single Azure resource. Created when you enable it on the resource and deleted when the resource is deleted. One-to-one relationship.
• User-assigned — created as a standalone Azure resource. Can be assigned to one or more Azure resources. Lifecycle is independent of the resources it's assigned to.

Why It Matters

Managed Identity gives you zero credentials, zero rotation, zero leaks.

Step 1: Enable System-Assigned Managed Identity on Logic App

1. Navigate to your Logic App in the Azure Portal
2. Select Identity from the left menu
3. Switch to the System assigned tab
4. Toggle Status to On
5. Click Save
6. Confirm the prompt to enable the identity

Azure will register the Logic App as a service principal in Azure AD. Note the Object ID — you'll need it for role assignments.

Step 2: Grant RBAC Role for Service Bus (Azure Service Bus Data Receiver)

1. Navigate to your Service Bus namespace
2. Select Access control (IAM)
3. Click Add → Add role assignment
4. Search for and select Azure Service Bus Data Receiver
5. Click Next
6. Select Managed identity
7. Click + Select members
8. Choose Logic App as the managed identity type
9. Select your Logic App from the list
10. Click Review + assign

Step 3: Grant RBAC Role for Storage (Storage Blob Data Contributor)

1. Navigate to your Storage account
2. Select Access control (IAM)
3. Click Add → Add role assignment
4. Search for and select Storage Blob Data Contributor
5. Click Next
6. Select Managed identity
7. Click + Select members
8. Choose Logic App as the managed identity type
9. Select your Logic App from the list
10. Click Review + assign

Step 4: Grant RBAC Role for Key Vault (Key Vault Secrets User)

1. Navigate to your Key Vault
2. Select Access control (IAM)
3. Click Add → Add role assignment
4. Search for and select Key Vault Secrets User
5. Click Next
6. Select Managed identity
7. Click + Select members
8. Choose Logic App as the managed identity type
9. Select your Logic App from the list
10. Click Review + assign

Note: Ensure your Key Vault uses Azure RBAC permission model, not the legacy access policies.

Step 5: Configure Logic App Connector to Use Managed Identity

1. Open your Logic App in the designer
2. Add or edit a connector action (e.g., Service Bus, Blob Storage)
3. When prompted for a connection, select Connect with managed identity
4. Provide a Connection name
5. Choose System-assigned managed identity
6. Click Create

For existing connections:

1. Go to API connections in the resource group
2. Select the connection
3. Click Edit API connection
4. Switch authentication to Managed Identity
5. Save

User-Assigned Managed Identity: When and How

When to Use User-Assigned MI

• Multiple resources need the same permissions
• You need the identity to persist beyond a single resource's lifecycle
• You want to pre-configure RBAC before deploying the resource
• Blue/green deployments where identity must remain stable

How to Create and Assign

1. Search for Managed Identities in the Azure Portal
2. Click Create
3. Select subscription, resource group, region, and name
4. Click Review + create

5. Navigate to your Logic App → Identity → User assigned tab
6. Click Add
7. Select the user-assigned identity
8. Click Add

Comparison: Connection String vs Managed Identity

Troubleshooting Managed Identity Issues

403 Forbidden After Assigning Role

• RBAC propagation can take up to 10 minutes. Wait and retry.
• Verify the role is assigned at the correct scope (resource vs resource group vs subscription).

Identity Not Appearing in Role Assignment

• Confirm the system-assigned identity is enabled (Status = On).
• Check you're searching in the correct Azure AD tenant.

Connector Fails with Authentication Error

• Ensure the Logic App identity has the data-plane role, not just a management role (e.g., use "Service Bus Data Receiver" not "Service Bus Contributor").
• Delete and recreate the API connection with MI authentication.

Token Acquisition Timeout

• Check if the resource is behind a private endpoint — the Logic App must have network access to Azure AD token endpoints.
• Verify no NSG rules are blocking outbound HTTPS to login.microsoftonline.com.

User-Assigned MI Not Working

• Confirm the identity is assigned to the Logic App under the User assigned tab.
• When multiple user-assigned identities exist, specify which one to use in the connector configuration.