Azure Integration built-in role
Logic App Operator
Reads, validates, enables, and disables Consumption logic app workflows without editing or updating their definitions. Its `Microsoft.Logic/*/read` wildcard includes the workflow access-key read operation, but not the separate operation that lists access-key secrets or the callback-URL Actions. It has no DataActions; Standard logic apps use the separate preview Standard Operator role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 515c2055-d9d4-4321-b1b9-bd0c9a0f79fe
Control-plane actions (17)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*/readMicrosoft.Insights/metricAlerts/*/readMicrosoft.Insights/diagnosticSettings/*/readMicrosoft.Insights/metricDefinitions/*/readMicrosoft.Logic/*/readMicrosoft.Logic/workflows/disable/actionMicrosoft.Logic/workflows/enable/actionMicrosoft.Logic/workflows/validate/actionMicrosoft.Resources/deployments/operations/readMicrosoft.Resources/subscriptions/operationresults/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*Microsoft.Web/connectionGateways/*/readMicrosoft.Web/connections/*/readMicrosoft.Web/customApis/*/readMicrosoft.Web/serverFarms/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Consumption logic app for one workflow boundary, or on a dedicated resource group when the operator supports every contained Consumption workflow. Parent assignments are inherited.
Common use cases (2)
- Let an operations team inspect, validate, enable, or disable a Consumption logic app without editing its workflow.
- Support incident response by pausing or re-enabling approved Consumption workflows.
Prerequisites (3)
- The Consumption logic app must already exist and the operator must be approved to view its configuration and run context.
- Define incident criteria for enable, disable, and validation actions before granting operational control.
- The operator must be approved for the workflow access-key read operation within the assignment scope.
Best practices (3)
- Assign on the individual logic app and use Contributor only for principals who edit workflows or connections.
- Secure sensitive inputs and outputs in run history and limit operator access to the workflow set the team supports.
- Treat the documented workflow access-key read operation as credential-sensitive even though this role lacks access-key secret listing and callback-URL Actions.
Security considerations (5)
- Disabling a workflow stops new trigger processing, while enabling it resumes automated execution and can affect business operations.
- Read access to workflow and run history can expose inputs, outputs, errors, and operational details unless sensitive data is secured.
- `Microsoft.Logic/workflows/accessKeys/read` is included by the read wildcard. The role does not include `workflows/accessKeys/list/action`, which Microsoft describes as listing access-key secrets, or workflow and trigger `listCallbackUrl/action` operations.
- The role cannot edit workflow definitions or grant Azure access.
- The published supporting Actions include `Microsoft.Support/*`; keeping the assignment on the individual logic app limits that wildcard compared with resource-group or subscription scope.
Assignment guidance
Assign Logic App Operator directly on the Consumption logic app to the operations group responsible for its availability only after accepting its workflow access-key read operation. Use Logic App Contributor for workflow changes and Standard Operator only for Standard logic apps.
Related roles (2)
- Logic App Contributor: Adds Consumption workflow and connection management.
- Logic Apps Standard Operator (Preview): Provides the preview operational role for Standard logic apps, including run resubmission and connection creation.
Common questions
When should I assign the Logic App Operator Azure role?
Assign Logic App Operator when you need to: Let an operations team inspect, validate, enable, or disable a Consumption logic app without editing its workflow.; and Support incident response by pausing or re-enabling approved Consumption workflows.. Practical scope: Assign on the individual Consumption logic app for one workflow boundary, or on a dedicated resource group when the operator supports every contained Consumption workflow. Parent assignments are inherited.
What permissions does the Logic App Operator Azure role grant?
The role definition grants 17 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*/read; Microsoft.Insights/metricAlerts/*/read; Microsoft.Insights/diagnosticSettings/*/read; Microsoft.Insights/metricDefinitions/*/read; and Microsoft.Logic/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Logic App Operator Azure role?
Key considerations when assigning Logic App Operator: Disabling a workflow stops new trigger processing, while enabling it resumes automated execution and can affect business operations.; Read access to workflow and run history can expose inputs, outputs, errors, and operational details unless sensitive data is secured.; `Microsoft.Logic/workflows/accessKeys/read` is included by the read wildcard. The role does not include `workflows/accessKeys/list/action`, which Microsoft describes as listing access-key secrets, or workflow and trigger `listCallbackUrl/action` operations.; and The role cannot edit workflow definitions or grant Azure access.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations, Related roles. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-17.
- Secure access and data for workflows in Azure Logic Apps →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Permissions for Integration - Microsoft.Logic →
Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.