{"id":6077,"date":"2021-11-26T18:46:24","date_gmt":"2021-11-26T18:46:24","guid":{"rendered":"https:\/\/rakhesh.com\/?p=6077"},"modified":"2021-12-09T13:59:43","modified_gmt":"2021-12-09T13:59:43","slug":"connecting-to-an-azure-function-using-a-logic-app-managed-identity","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/azure\/connecting-to-an-azure-function-using-a-logic-app-managed-identity\/","title":{"rendered":"Connecting to an Azure Function using a Logic App Managed Identity"},"content":{"rendered":"

In a previous post<\/a> I showed how to connect to an Azure Function using Azure AD authentication.<\/p>\n

To recap<\/strong>: I have an Azure Function. Using PowerShell. I enabled Azure AD authentication for it. And as of writing I am able to connect to it only if I am authenticated via Azure AD (there’s some changes I made to the App Registration for my specific use case as detailed in the blog post).<\/p>\n

\"\"<\/p>\n

Now I want to connect to this Azure Function from a Logic App. I want to run the HTTP action basically to call that endpoint and get the Function to do something.<\/p>\n

Would this work?<\/p>\n

\"\"<\/p>\n

Of course not, but I wanted to try it to confirm.<\/p>\n

\"\"<\/p>\n

The Logic App has its own identity so ideally I can use that to access the Azure Function. There’s even a nice doc with examples<\/a> (thank you! it’s always great when there are examples and some screenshots) so all I have to do is tell the Logic App to use the Managed Identity.<\/p>\n

\"\"<\/p>\n

And that works!<\/p>\n

\"\"<\/p>\n

Gotcha! Of course it wouldn’t work. If only things were so simple I wouldn’t have to spend time figuring them or write a blog post. \ud83d\ude42<\/p>\n

After a lot of Googling and trying things I noticed this paragraph in the link I referred to earlier:<\/p>\n

\"\"<\/p>\n

Not sure what to put as the audience here but I am think it’s the App Registration. After all I haven’t put that anywhere and that’s the kind of thing you’d have to mention so you get tokens for that.<\/p>\n

So I added that:<\/p>\n

\"\"<\/p>\n

And it works!<\/p>\n

\"\"<\/p>\n

Wow, that was kind of easy. (Not really, I make it sound easy but I did have to Google a bit… but that’s mostly me not knowing anything. I’d like to go with this being super easy to use. Compared to my previous post where I had to exchange tokens and such this one’s a breeze!).<\/p>\n

However…<\/p>\n

One reason why I didn’t stumble upon this so easily is because by this point I had locked down the App Registration to specific users. You can do that via the Enterprise Application of the App Registration. So I actually had a group that this Application was limited to and I had added the Managed Identity of the Logic App to this group. (A mistake, in retrospect. Although I added it to the group it was getting ignored because you can only assign users or groups to the Application… not Managed Identities<\/em>).<\/p>\n

When the Application is limited to specific users I get a different error even with the Audience filled in:<\/p>\n

\"\"<\/p>\n

Bummer.<\/p>\n

So what do we have so far<\/strong>: If I aren’t doing any user\/ group restrictions then things work perfectly. I can have an Azure Function that requires Azure AD authentication with only users, groups, and Managed Identities from my tenant (because that’s how the App Registration is set) being able to access it. That’s pretty secure. It’s only if I want to lock down that Function to a specific set of users\/ groups that I can’t have it also be called from a Logic App as I run into the above error.<\/p>\n

Is there a way to restrict the Function to users\/ groups and also specific Logic Apps? Yes.<\/p>\n

App Roles and all that…<\/h3>\n

Thanks to this document<\/a> for what follows. I came across it via another document on adding App Roles<\/a>.<\/p>\n

First thing to do is create the App Role in the App Registration of the Azure Function:<\/p>\n

\"\"<\/p>\n

The name and whatever you put in there doesn’t matter. I put a name that has my Logic App’s name in it so I know what it is for later. The Value and Description can be anything too. Be sure to tick the box to enable it.<\/p>\n

Note the ID of this App Role.<\/strong><\/p>\n

\"\"<\/p>\n

Now go to the Logic App in Azure AD. It is under Enterprise Applications. (Alternatively go to the Logic App and check its Identity section). Note its Object ID<\/strong>.<\/p>\n

\"\"<\/p>\n

Then go the Enterprise Application of the Azure Function App Registration. (That’s a mouthful. I should just start saying Service Principal<\/strong>. The “object” you see in Enterprise Application is the Service Principal. This can be for something in your tenant (in which case it has a component in App Registrations) or another tenant (e.g. the Managed Identity of the Logic App – its Service Principal is from the Microsoft tenant)).<\/p>\n

(Update<\/strong>: When I tried this again the above didn’t work and I had to use the Object ID of the Service Principal of the App Registration I had restricted the Azure Function to).<\/p>\n

Anyways, go to that and note its Object ID<\/strong>.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Now we have to tie in the Logic App’s Managed Identity to the App Role we created. For this we have to use PowerShell:<\/p>\n

# Object ID of the Managed Identity\r\n$managedIdentityObjectId = \"1f0b85e3-b2e0-47b4-8f81-eb294162982a\"\r\n\r\n# ID of the App Role\r\n$appRoleId = \"21f1d005-9564-4b51-b10d-5dd8f8c61552\"\r\n\r\n# Object ID of the Service Principal of the Azure Function App Registration\r\n$serverServicePrincipalObjectId = \"a478d5cc-9e31-4cc5-84ad-bfd0e6b31a06\"    \r\n\r\nConnect-AzureAD\r\nNew-AzureADServiceAppRoleAssignment -ObjectId $managedIdentityObjectId `\r\n                                    -Id $appRoleId -PrincipalId $managedIdentityObjectId `\r\n                                    -ResourceId $serverServicePrincipalObjectId<\/pre>\n
If you are on macOS or Linux use Cloud Shell<\/a> in the Portal.<\/p>\n
With all this done my Logic App now connects to the Azure Function with no issues! \ud83d\ude42<\/p>\n
\"\"<\/p>\n","protected":false},"excerpt":{"rendered":"
In a previous post I showed how to connect to an Azure Function using Azure AD authentication. To recap: I have an Azure Function. Using PowerShell. I enabled Azure AD authentication for it. And as of writing I am able to connect to it only if I am authenticated via Azure AD (there’s some changes … Continue reading Connecting to an Azure Function using a Logic App Managed Identity<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[887],"tags":[1024,1050,982,105,1046],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/6077"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=6077"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/6077\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=6077"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=6077"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=6077"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}