Azure Integration built-in role

Logic Apps Standard Reader (Preview)

A preview control-plane role with read access to a Standard logic app, workflows, runs, and history. Its `Microsoft.Web/*/read` wildcard also exposes app configuration, function keys, Functions tokens, and master-key reads. It has no DataActions and cannot edit the Logic Apps assets, but its supporting Actions include classic alert-rule and support-ticket management.

Control-plane actions (7)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/operations/read
• Microsoft.Resources/subscriptions/operationresults/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.Web/*/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual Standard logic app whose resources and run history the principal may inspect. A resource-group assignment is inherited by every Standard app and related Microsoft.Web resource below it.

Common use cases (2)

• Let a support engineer or auditor inspect Standard workflows, run status, inputs, outputs, and history without changing the app.
• Give service owners visibility into one Standard logic app for troubleshooting and operational review.

Prerequisites (3)

• The Standard logic app and workflows to review must already exist.
• The reviewer must be approved to see run-history inputs and outputs, which can contain sensitive business data and credentials.
• The reviewer must also be approved to read app configuration, function keys, Functions tokens, and the master key within the app scope.

Best practices (3)

• Assign on the individual Standard logic app and secure sensitive trigger and action inputs and outputs, app configuration, and retrieved Functions credentials.
• Use Operator only when the principal must resubmit runs or change app state, and review this preview role as its definition evolves.
• Avoid resource-group or subscription scope when the reader should not receive supporting alert and support operations over unrelated resources.

Security considerations (5)

• Run history can expose request and response payloads, passwords, secrets, keys, and other sensitive information unless the workflow secures those inputs and outputs.
• `Microsoft.Web/*/read` includes app-setting and connection-string reads, host-runtime function-key reads, Functions-token reads, and both `sites/functions/masterkey/read` and `sites/hostruntime/host/_master/read` master-key operations.
• The role does not grant workflow-trigger callback-URL Actions, per-function `listSecrets`, or the distinct host-key listing Action whose response also contains system keys.
• A parent-scope assignment exposes the same run-history, configuration, function-key, token, and master-key reads across every inherited Standard logic app.
• The role is preview and has no DataActions, but it can manage classic alert rules and create or update support tickets within its effective scope.

Assignment guidance

Assign Logic Apps Standard Reader (Preview) to approved reviewers on the individual Standard logic app only after accepting its configuration, function-key, Functions-token, and master-key reads. Secure run-history data and Functions credentials first, and review a different role only for a separately documented duty.

Related roles (3)

• Logic Apps Standard Operator (Preview): Adds run resubmission, connection creation, and app operational control.
• Logic Apps Standard Developer (Preview): Adds workflow, connection, and workflow-scoped settings edits.
• Logic Apps Standard Contributor (Preview): Adds broad Standard logic app administration.

Editorial sources (9)

• Azure built-in roles for Integration - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-17.

• Secure access and data for workflows in Azure Logic Apps →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Permissions for Web and Mobile - Microsoft.Web →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Work with access keys in Azure Functions →

  Supports: Description, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Web Apps - List Host Keys →

  Supports: Security considerations. Retrieved 2026-07-17.

Official Microsoft Learn documentation →