Governance Policies Azure Management Logic Apps

Logic Apps

Governance policies for Logic Apps

Domain: azure-management

Patterns

Name	Description
Logic App with managed identity and access control	Secure Logic App with managed identity, IP restrictions, and Key Vault-backed parameters

Anti-Patterns

Description	Instead
Do not hardcode credentials in workflow parameters	Use managed identity for API connections and Key Vault references for secrets
Do not expose trigger URLs without access restrictions	Configure allowedCallerIpAddresses to restrict trigger invocation

References

• Logic Apps security overview
• Logic Apps managed identity

---

Checks (4)

Check	Severity	Description
AZ-LA-001	Required	Deploy Logic Apps Standard with managed identity, VNet integration, and disabled public access
AZ-LA-002	Required	Use managed identity for all API connections instead of connection strings
AZ-LA-003	Recommended	Configure IP-based access control for triggers, actions, and management endpoints
AZ-LA-004	Recommended	Enable diagnostic logging for workflow runs and trigger history

---

AZ-LA-001

Deploy Logic Apps Standard with managed identity, VNet integration, and disabled public access

Severity: Required
Rationale: Logic Apps process business workflows that often handle sensitive data; managed identity eliminates connection credentials
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

• Microsoft.Logic/workflows

Companion Resources

Resource	Name	Purpose
Microsoft.Insights/diagnosticSettings	diag-logic-app	Diagnostic settings to route workflow run logs and trigger events to Log Analytics
Microsoft.Authorization/roleAssignments	Logic App Contributor	RBAC role assignments for Logic App management

---

AZ-LA-002

Use managed identity for all API connections instead of connection strings

Severity: Required
Rationale: Connection strings are shared secrets; managed identity provides per-connection, auditable access
Agents: terraform-agent, bicep-agent, cloud-architect, app-developer, csharp-developer, python-developer

Targets

• Microsoft.Logic/workflows

---

AZ-LA-003

Configure IP-based access control for triggers, actions, and management endpoints

Severity: Recommended
Rationale: IP restrictions limit who can invoke workflows and access run history
Agents: terraform-agent, bicep-agent, cloud-architect, security-reviewer

Targets

• Microsoft.Logic/workflows

---

AZ-LA-004

Enable diagnostic logging for workflow runs and trigger history

Severity: Recommended
Rationale: Workflow logs provide audit trail and troubleshooting data for business process execution
Agents: terraform-agent, bicep-agent, cloud-architect, monitoring-agent

Targets

• Microsoft.Logic/workflows

---