In the standard logic app deployed from Azure Portal, the system managed identity is enabled by default. However, the workflow action "Run KQL query" from connector Azure Data Explorer gets a 403 forbidden error through user managed identity authentication (see below for the error message), unless the logic app's system managed identity is disabled.
Error message:
Error from token exchange: Permission denied due to missing connection ACL: User = <User mananged identity's principal Id>@<User mananged identity's tenant Id> appid=<User mananged identity's principal Id>, connection=logic-apis-eastus/kusto/<GUID>
Plan Type
Standard
Steps to Reproduce the Bug or Issue
Deploy a standard logic app through portal, which should have system managed identity enabled
Add a user managed identity that has access to a Kusto cluster to the logic app
Create a workflow and add a "Run KQL query" action. Specify that the authentication is through the User managed identity
Run the workflow, which returns a 403 forbidden on the KQL query action
Additionally, I repeated the below steps a couple of times, which shows a consistent behavior that having both system MI and UMI together yields 403:
Disable system managed identity. Use the existing connector with UMI yields 403 forbidden. But creating a new connector with the same UMI works.
Re-enable system managed identity. Use the existing UMI works. But creating a new connector with the same UMI yields 403 again.
Describe the Bug
In the standard logic app deployed from Azure Portal, the system managed identity is enabled by default. However, the workflow action "Run KQL query" from connector Azure Data Explorer gets a 403 forbidden error through user managed identity authentication (see below for the error message), unless the logic app's system managed identity is disabled.
Error message:
Plan Type
Standard
Steps to Reproduce the Bug or Issue
Additionally, I repeated the below steps a couple of times, which shows a consistent behavior that having both system MI and UMI together yields 403:
Workflow JSON
Screenshots or Videos
No response
Additional context
No response