managed connector authenticates with SAMI instead of selected UAMI when both identities are enabled
- Dominant language
- TypeScript
- Stars
- 111
- Forks
- 109
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 20
Description
### Severity
P2 - High (Major functionality broken)
### Describe the Bug with repro steps
Describe the Bug
When both System-Assigned Managed Identity (SAMI) and User-Assigned Managed Identity (UAMI) are enabled on a Logic App, selecting UAMI as the authentication identity for managed connectors (e.g., azuresentinel, azuremonitorlogs) does not take effect. The connector silently falls back to SAMI at runtime, despite the UI showing UAMI as the selected identity.
Repro Steps
Create a Logic App
Enable System-Assigned Managed Identity (SAMI) under Identity settings
Attach a User-Assigned Managed Identity (UAMI) under Identity settings
Add a managed connector action (e.g., Microsoft Sentinel or Azure Monitor Logs)
Create a new connection using "Logic Apps Managed Identity" and explicitly select the UAMI
Assign the required RBAC roles to the UAMI on the target resource
Run the workflow
Expected Behavior
The connector authenticates using the selected UAMI and its associated permissions.
Actual Behavior
The connector authenticates using SAMI instead of the selected UAMI, resulting in AuthorizationFailed errors because the RBAC roles were assigned to the UAMI, not SAMI. The error message references the SAMI Object ID, confirming SAMI is being used.
-----
Appendix
-----
My error code:
`
{
"StatusCode": "Forbidden",
"ReasonPhrase": "Forbidden",
"Content": "{\"error\":{\"code\":\"AuthorizationFailed\",\"message\":\"The client 'f7fa*****' with object id 'ff10****' does not have authorization to perform action 'Microsoft.SecurityInsights/incidents/comments/write' over scope '/
`
object id 'ff10****' is my logic app's system assigned management identity but i connected this action to user managed identity(6b50*****)
finally, i do shut off logic app's system assigned managed identity to resolve this problem :<
best regards.
### What type of Logic App Is this happening in?
Consumption (Portal)
### Are you experiencing a regression?
_No response_
### Which operating system are you using?
Windows
### Did you refer to the TSG before filing this issue? https://aka.ms/lauxtsg
Yes
### Workflow JSON
```json
```
### Screenshots or Videos
_No response_
### Environment
Browser - Zen Version 1.21.3b (64-bit)
### Additional context
_No response_
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the issue in a Consumption Logic App from the portal with both SAMI and UAMI enabled, then create a managed connector connection for the selected UAMI. Trace the connector authentication identity selection and compare the runtime identity with the workflow connection configuration. Done means the connector uses the selected UAMI and succeeds with roles assigned only to that identity.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- authentication, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100