Azure Integration built-in role

Logic Apps Standard Operator (Preview)

A preview control-plane role for Standard logic app operations and support. It can enable and disable the app, resubmit workflow runs, create connections, and perform documented site and slot operations. Its read and host-runtime permissions also expose workflow callback URLs, function keys, Functions tokens, configuration, and a master-key operation even though two host-runtime operations are excluded.

Control-plane actions (19)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/operations/read
• Microsoft.Resources/subscriptions/operationresults/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.Web/*/read
• Microsoft.Web/sites/applySlotConfig/Action
• microsoft.web/sites/hostruntime/*
• Microsoft.Web/sites/restart/Action
• Microsoft.Web/sites/slots/restart/Action
• Microsoft.Web/sites/slots/slotsswap/Action
• Microsoft.Web/sites/slots/start/Action
• Microsoft.Web/sites/slots/stop/Action
• Microsoft.Web/sites/slotsdiffs/Action
• Microsoft.Web/sites/slotsswap/Action
• Microsoft.Web/sites/start/Action
• Microsoft.Web/sites/stop/Action
• Microsoft.Web/sites/write

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (2)

• Microsoft.Web/sites/hostruntime/host/_master/read
• Microsoft.Web/sites/hostruntime/host/action

Assignable scopes (1)

• /

Practical scope

Assign on the individual Standard logic app operated by the support team. Resource-group scope inherits operational and connection authority across every Standard app and related site resource in that group.

Common use cases (2)

• Let an operations team start, stop, restart, enable, or disable a Standard logic app and resubmit approved workflow runs.
• Create required service connections during support without granting workflow-definition or settings edits.

Prerequisites (3)

• The Standard logic app and workflows must already exist, and the operations team must have documented run-resubmission and connection procedures.
• Review downstream side effects and idempotency before resubmitting a workflow run.
• The operations team must be approved to read app configuration, workflow callback URLs, function keys, Functions tokens, and the master key within the app scope.

Best practices (3)

• Assign on one Standard logic app and use Reader for observation-only support.
• Require incident or change approval for run resubmission, slot swaps, connection creation, and app start or stop actions.
• Secure run-history inputs and outputs, protect retrieved Functions credentials, and revalidate this preview role as its definition evolves.

Security considerations (6)

• Resubmitting a workflow can repeat external side effects such as messages, writes, payments, or notifications.
• Creating connections can introduce credentialed access to external services, while site and slot operations can affect availability and deployed behavior.
• `sites/hostruntime/*` includes workflow-trigger callback-URL and function-key reads. `NotActions` subtract `sites/hostruntime/host/_master/read` and `sites/hostruntime/host/action`, but the separate `Microsoft.Web/sites/functions/masterkey/read` operation still matches `Microsoft.Web/*/read` and exposes the Functions master key.
• The role does not grant the distinct `sites/host/listkeys/action` response containing host-level function keys and system keys, and it does not grant the security-sensitive `sites/config/list/action`; its broad reads still include app configuration and Functions-token operations.
• The role is preview, cannot edit workflows or settings, and has no DataActions.
• The published supporting Actions include `Microsoft.Insights/alertRules/*` and `Microsoft.Support/*`; parent scope extends those wildcards beyond the Standard logic app.

Assignment guidance

Assign Logic Apps Standard Operator (Preview) to the operations group on the individual Standard logic app only after accepting its callback-URL, function-key, Functions-token, configuration-read, and remaining master-key authority. Use a separately reviewed role when run control is unnecessary or configuration changes are required.

Related roles (3)

• Logic Apps Standard Reader (Preview): Provides run-history and resource visibility without operational changes or resubmission.
• Logic Apps Standard Developer (Preview): Adds workflow, connection, and workflow-scoped settings edits.
• Logic Apps Standard Contributor (Preview): Adds full Standard logic app management except access and ownership changes.

Editorial sources (9)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Secure access and data for workflows in Azure Logic Apps →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Permissions for Web and Mobile - Microsoft.Web →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Work with access keys in Azure Functions →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Web Apps - List Host Keys →

  Supports: Security considerations. Retrieved 2026-07-17.

Official Microsoft Learn documentation →