Azure Integration built-in role

Logic App Contributor

Manages Consumption logic app workflows and supporting Logic Apps resources without changing Azure role assignments. Its control-plane Actions include current and classic storage-account key listing, the full Microsoft.Logic operation set, API-connection operations, and per-function secret listing; it has no DataActions, but these credential-bearing Actions can enable access outside the Azure Resource Manager control plane. Standard logic apps use the separate preview Standard roles.

Control-plane actions (21)

• Microsoft.Authorization/*/read
• Microsoft.ClassicStorage/storageAccounts/listKeys/action
• Microsoft.ClassicStorage/storageAccounts/read
• Microsoft.Insights/alertRules/*
• Microsoft.Insights/metricAlerts/*
• Microsoft.Insights/diagnosticSettings/*
• Microsoft.Insights/logdefinitions/*
• Microsoft.Insights/metricDefinitions/*
• Microsoft.Logic/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/operationresults/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Storage/storageAccounts/listkeys/action
• Microsoft.Storage/storageAccounts/read
• Microsoft.Support/*
• Microsoft.Web/connectionGateways/*
• Microsoft.Web/connections/*
• Microsoft.Web/customApis/*
• Microsoft.Web/serverFarms/join/action
• Microsoft.Web/serverFarms/read
• Microsoft.Web/sites/functions/listSecrets/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the resource group containing the Consumption logic app and its API connections only when the principal must manage that documented end-to-end workflow. A direct logic-app assignment narrows inheritance and does not cover sibling connection, storage, or Function resources; a resource-group assignment makes the storage-key and Function-secret Actions effective against matching sibling resources throughout that group.

Common use cases (2)

• Create, edit, deploy, enable, disable, and manage a Consumption logic app and its connections.
• Operate a Consumption workflow lifecycle without granting Azure role-assignment authority.

Prerequisites (3)

• The principal must be responsible for a Consumption logic app, not a Standard logic app.
• When authenticating connections for a workflow the principal did not create, Microsoft documents Contributor permissions on the resource group containing the logic app resource.
• Inventory every current or classic storage account, Consumption workflow, API connection, and Function app in the proposed assignment scope and confirm that exposing its account keys, workflow access secrets and callback URLs, connection keys, or per-function keys is acceptable.

Best practices (4)

• Use Logic App Operator for support staff who only read, validate, enable, or disable workflows.
• Keep the resource group limited to the logic app and related integration resources when assigning Contributor; place unrelated storage accounts and Function apps outside that scope.
• Treat storage key listing, workflow access-key and callback-URL listing, API-connection key listing, and per-function key listing as credential access. Prefer Microsoft Entra authorization and managed identities where supported, and rotate any exposed key.
• Secure sensitive trigger and action inputs and outputs in run history and use managed identities or protected connection credentials where supported.

Security considerations (7)

• The role can change or delete workflows, connections, integration artifacts, and supporting resources, affecting automated business processes.
• Current and classic storage account keys can authorize full access to storage account data and can sign SAS tokens; listing them is credential authority even though the role has no DataActions.
• `Microsoft.Web/sites/functions/listSecrets/action` maps to the per-function key API. It does not by itself grant the distinct host-key API, whose response contains host-level function keys, system keys, and the master key.
• The `Microsoft.Logic/*` wildcard includes operations that list workflow access-key secrets and workflow or trigger callback URLs, and `Microsoft.Web/connections/*` includes API-connection key listing.
• Logic app run history can contain request and response inputs, outputs, passwords, secrets, keys, and other sensitive information unless secured.
• The role does not grant Azure role-assignment write or Logic Apps data-plane DataActions.
• The published supporting Actions also include `Microsoft.Insights/alertRules/*` and `Microsoft.Support/*`; resource-group or subscription scope extends those wildcards beyond the logic app.

Assignment guidance

Assign Logic App Contributor to the workflow engineering group on a dedicated resource group containing the Consumption logic app and required connections only after reviewing every storage key, workflow access key or callback URL, API-connection key, and per-function key exposed at that scope. Use direct logic-app scope when sibling resources are unnecessary, Logic App Operator for run support without editing, and the preview Standard roles only for Standard logic apps.

Related roles (2)

• Logic App Operator: Reads, validates, enables, and disables Consumption logic apps without editing them.
• Logic Apps Standard Contributor (Preview): Provides broad management for Standard logic apps and remains explicitly preview.

Editorial sources (12)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Prerequisites, Security considerations, Related roles. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Secure access and data for workflows in Azure Logic Apps →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Permissions for Integration - Microsoft.Logic →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Permissions for Web and Mobile - Microsoft.Web →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Manage storage account access keys →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Work with access keys in Azure Functions →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Web Apps - List Function Keys →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Web Apps - List Host Keys →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →