Azure / Azure/LogicAppsUX

managed connector authenticates with SAMI instead of selected UAMI when both identities are enabled

Open
#9,302 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
111
Forks
109
Avg merge
1d 23h
Merged PRs (30d)
20

Description

### Severity

P2 - High (Major functionality broken)

### Describe the Bug with repro steps

Describe the Bug
When both System-Assigned Managed Identity (SAMI) and User-Assigned Managed Identity (UAMI) are enabled on a Logic App, selecting UAMI as the authentication identity for managed connectors (e.g., azuresentinel, azuremonitorlogs) does not take effect. The connector silently falls back to SAMI at runtime, despite the UI showing UAMI as the selected identity.
Repro Steps

Create a Logic App
Enable System-Assigned Managed Identity (SAMI) under Identity settings
Attach a User-Assigned Managed Identity (UAMI) under Identity settings
Add a managed connector action (e.g., Microsoft Sentinel or Azure Monitor Logs)
Create a new connection using "Logic Apps Managed Identity" and explicitly select the UAMI
Assign the required RBAC roles to the UAMI on the target resource
Run the workflow

Expected Behavior
The connector authenticates using the selected UAMI and its associated permissions.
Actual Behavior
The connector authenticates using SAMI instead of the selected UAMI, resulting in AuthorizationFailed errors because the RBAC roles were assigned to the UAMI, not SAMI. The error message references the SAMI Object ID, confirming SAMI is being used.

-----
Appendix
-----
My error code:
`
{
"StatusCode": "Forbidden",
"ReasonPhrase": "Forbidden",
"Content": "{\"error\":{\"code\":\"AuthorizationFailed\",\"message\":\"The client 'f7fa*****' with object id 'ff10****' does not have authorization to perform action 'Microsoft.SecurityInsights/incidents/comments/write' over scope '/
`
object id 'ff10****' is my logic app's system assigned management identity but i connected this action to user managed identity(6b50*****)
finally, i do shut off logic app's system assigned managed identity to resolve this problem :<

best regards.

### What type of Logic App Is this happening in?

Consumption (Portal)

### Are you experiencing a regression?

_No response_

### Which operating system are you using?

Windows

### Did you refer to the TSG before filing this issue? https://aka.ms/lauxtsg

Yes

### Workflow JSON

```json

```

### Screenshots or Videos

_No response_

### Environment

Browser - Zen Version 1.21.3b (64-bit)

### Additional context

_No response_

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the issue in a Consumption Logic App from the portal with both SAMI and UAMI enabled, then create a managed connector connection for the selected UAMI. Trace the connector authentication identity selection and compare the runtime identity with the workflow connection configuration. Done means the connector uses the selected UAMI and succeeds with roles assigned only to that identity.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authentication, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.