Azure Access and Roles for the Logic Apps Agent
Every call the Nodinite Azure Logic Apps Logging and Monitoring Agent makes to Azure uses one App Registration in Microsoft Entra ID. The roles you give that App Registration decide what the agent can do: read the state of your Logic Apps, enable and resubmit them, read their run history retention, and read the diagnostics stream for logging. Give it only the roles for the features you use. This page is part of the Prerequisites; the network side is in Firewall Settings.
The App Registration
The agent always authenticates with an App Registration (application and client secret) in Microsoft Entra ID, for every subscription you add. Follow Azure Application Access to create it and to find the Tenant ID, Subscription ID, Client ID, and Client Secret that you enter on the Authentication tab. The full least-privilege reference, including a custom role, is Azure Application Access - Least Privileges.
Azure RBAC roles per feature
Assign Azure RBAC roles to the App Registration for the features you use:
| Feature | Scope | Built-in role | Notes |
|---|---|---|---|
| Monitoring and discovery | Subscription, or each monitored Resource Group | Reader | Inherits to all resources in the scope. Monitoring Reader is not needed |
| Enable or disable Consumption workflows | Workflows, Resource Group, or Subscription | Logic App Operator | Can't resubmit runs |
| Resubmit Consumption runs | Workflows, Resource Group, or Subscription | Logic App Contributor | Includes enable and disable |
| Enable, disable, and resubmit Standard workflows | Standard Logic App, Resource Group, or Subscription | Logic Apps Standard Operator | Microsoft's Logic App Operator and Logic App Contributor roles apply to Consumption only |
| Run history retention, Standard | Logic App, Resource Group, or Subscription | A role with Microsoft.Web/sites/config/list/action |
Reader doesn't include it |
| Logging and failed runs: read the Event Hub | Event Hub or its namespace | Azure Event Hubs Data Receiver New 6.1.29 | When the Event Hub entry uses the App Registration (Use Client Secret Credential) |
| Logging and failed runs: write the checkpoint | Checkpoint Storage Container, or its Storage account | Storage Blob Data Contributor New 6.1.29 | When the Event Hub entry uses the App Registration |
The remote actions that need the Operator and Contributor roles are described in Managing Logic Apps.
Note
Each Event Hub entry uses either the App Registration with the two roles above, or Event Hub and Storage connection strings (SAS keys from a Shared access policy), which need no role but fail when local (SAS) authentication is disabled on the namespace. The App Registration is required either way, for the Azure REST API. See Configure Event Hubs.
When the Event Hub lives in another subscription than the workflows, assign the Event Hub roles on that subscription.