azureazure-logic-apps

Logic App Standard: extension bundle doesn't support connecting to the storage account using Managed Service Identity

I have a Logic App Standard with two workflows, one uses a manual trigger and the other a timer trigger. Both run successfully locally in VSCode. Once deployed to Azure, the function app fails with the following error: Microsoft.WindowsAzure.Storage: Value cannot be null. (Parameter 'connectionString').

It seems that the extension bundle in use doesn't support Managed Service Identity (MSI) when connecting to the storage account, here is my host.json:

{
  "version": "2.0",
  "logging": {
    "applicationInsights": {
      "samplingSettings": {
        "isEnabled": true,
        "excludedTypes": "Request"
      }
    }
  },
  "extensionBundle": {
    "id": "Microsoft.Azure.Functions.ExtensionBundle.Workflows",
    "version": "[1.*, 2.0.0)"
  }
}

I have added the following application setting already but it doesn't seem to be supported:

AzureWebJobsStorage__accountName=storageaccountname

Any guidance or advice in where to look in order to find out where the problem is?

Note that there is a policy in place preventing the use of access keys for storage accounts hence the need to connect using MSI.

Solution

  • Standard logic app by default connects to storage account using connection string but if you would like to use identity based connection then you need to go for user assigned managed identity as of now user assigned managed identity is only supported.

    You can also refer to this MS Doc which says the same.

    By default, your Standard logic app authenticates access to your Azure Storage account by using a connection string. However, you can set up a user-assigned managed identity to authenticate access instead.

    In order to authenticate using user-assigned managed identity and disable the use of storage connection string, you need to create the logic app in App Service Environment v3 hosting option.

    Add the below RBAC roles to user assigned managed identity instance in storage account.

    enter image description here

    Add the user-assigned managed identity to your standard logic app instance.

    Delete AzureWebJobsStorage from App settings and use the below given values.

    Save the changes. You might get a message "AzureWebjobsStorage" app setting is not present. in Overview blade of your logic app but it will not affect the logic app and will work as expected.