Azure Integration built-in role

Logic Apps Standard Operator (Preview)

A preview control-plane role for Standard logic app operations and support. It can enable and disable the app, resubmit workflow runs, create connections, and perform documented site and slot operations. Its read and host-runtime permissions also expose workflow callback URLs, function keys, Functions tokens, configuration, and a master-key operation even though two host-runtime operations are excluded.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: b70c96e9-66fe-4c09-b6e7-c98e69c98555

Microsoft Learn identifies this role as Preview in its published role name.

Control-plane actions (19)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (2)

Assignable scopes (1)

Practical scope

Assign on the individual Standard logic app operated by the support team. Resource-group scope inherits operational and connection authority across every Standard app and related site resource in that group.

Common use cases (2)

Prerequisites (3)

Best practices (3)

Security considerations (6)

Assignment guidance

Assign Logic Apps Standard Operator (Preview) to the operations group on the individual Standard logic app only after accepting its callback-URL, function-key, Functions-token, configuration-read, and remaining master-key authority. Use a separately reviewed role when run control is unnecessary or configuration changes are required.

Related roles (3)

Common questions

When should I assign the Logic Apps Standard Operator (Preview) Azure role?

Assign Logic Apps Standard Operator (Preview) when you need to: Let an operations team start, stop, restart, enable, or disable a Standard logic app and resubmit approved workflow runs.; and Create required service connections during support without granting workflow-definition or settings edits.. Practical scope: Assign on the individual Standard logic app operated by the support team. Resource-group scope inherits operational and connection authority across every Standard app and related site resource in that group.

What permissions does the Logic Apps Standard Operator (Preview) Azure role grant?

The role definition grants 19 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/operations/read; Microsoft.Resources/subscriptions/operationresults/read; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Support/*. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Logic Apps Standard Operator (Preview) Azure role?

Key considerations when assigning Logic Apps Standard Operator (Preview): Resubmitting a workflow can repeat external side effects such as messages, writes, payments, or notifications.; Creating connections can introduce credentialed access to external services, while site and slot operations can affect availability and deployed behavior.; `sites/hostruntime/*` includes workflow-trigger callback-URL and function-key reads. `NotActions` subtract `sites/hostruntime/host/_master/read` and `sites/hostruntime/host/action`, but the separate `Microsoft.Web/sites/functions/masterkey/read` operation still matches `Microsoft.Web/*/read` and exposes the Functions master key.; and The role does not grant the distinct `sites/host/listkeys/action` response containing host-level function keys and system keys, and it does not grant the security-sensitive `sites/config/list/action`; its broad reads still include app configuration and Functions-token operations.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (9)

Official Microsoft Learn documentation →