azureazure-logic-appskqlazure-sentinel

Logic Apps copy action gives: The managed identity used with this operation no longer exists. To continue, set up an identity or change the connection

I have a simple flow in Logic Apps - it runs some KQL against Sentinel, creates a CSV from the results and attaches the CSV to an email and sends it.

I want to run 2 KQL queries, and attach 2 CSVs to the email - so I copy the "Run Query and List Results" action, and paste it when adding a new action - however the new (copied) action shows the error:

Error message

Flow

The Subscription, Resource Group, Resource Type and Resource Name are all identical.

Does anyone have any idea what is wrong, and how I can get this flow to run two KQL queries?

Thanks for any help,

Mark

Solution

  • Make sure that the managed identity selected in your Run query and list results-copy action is correct:

    Managed identity

    You can also check its ID in the Code View:

    Code view

    This managed identity should have a proper role assigned to access your logs, e.g. in my environment it looks like this:

    Access control