Loading...

How to query Azure Monitor Log Analytics in Logic Apps with a Managed Identity and output results in a SharePoint list

How to query Azure Monitor Log Analytics in Logic Apps with a Managed Identity and output results in a SharePoint list

Azure Monitor Log Analytics is super powerful to collect data and give you insights on what’s going on with your apps and resources. There is even an Azure Monitor Logs connector for Logic Apps.

⚡ Very unfortunately, the connector doesn’t support authentication with a Managed Identity - which means that you’d need either to be a signed-in user or use an app registration, which comes with its own challenges on secret handling. I explained in my previous blog posts why Managed Identities are a way superior way to authenticate.

Azure Monitor connector

💡 Azure Log Analytics REST API to the rescue!

We can call the Azure Log Analytics REST API from Logic Apps with the generic HTTP action - and authenticate with a Managed Identity. For this example, I chose a user-assigned Managed Identity, so that you can reuse it across resources, but of course you can go with a system-assigned Managed Identity as well.

I wanted to create a sample on how to create a Logic App that queries Log Analytics with a user-assigned Managed Identity that has the Log Analytics Reader assigned. The Managed Identity also has Microsoft Graph permissions with scope Sites.ReadWrite.All assigned in order to create new items in a SharePoint list about the result of a query of Azure Monitor logs. That could be beneficial for users who don’t have access to the logs but should be notified or similar.

Deployment

  1. Fork and clone this repository
  2. Browse to the root folder in your clone
  3. Connect to the Azure subscription that you want this to run in
  4. Run the deploy.ps1 script, it will
    • create the resource group
    • create the resources
    • assign the Log Analytics role to the Managed Identity
    • assign Graph API Sites.ReadWrite.All permissions to the Managed Identity
  5. You will be prompted to provide
    • a location for your resources
    • a Resource group name
    • the siteID of the site your list lives in
    • the listId of the list in which new rows shall be created

Validate deployment

  1. Check in the Azure Portal after you read the success-message Resources deployed successfully, role assigned

    • Resource group
    • Logic App
    • Azure Log Workspace
    • Managed Identity

resource group

  1. In the Logic App, the Authentication works with the Managed Identity LogicApps-auth

  2. Our Managed Identity has the Log Analytics Reader role assigned Managed Identity

  3. Our Managed Identity has the SitesReadWrite.All permission assigned Graph permissions

Our Logic App should look like this:

complete Logic App

💡 Please make sure that you insert a query into the Logic app that makes sense depending on your scenario. Also adjust the body of the Create list item action to match your SharePoint list.

Conclusion

Connectors can be a good way to easily achieve what you need in Logic Apps. However, they sometimes don’t fit your scenario or don’t support your way of doing things - like I really like Managed Identities. Therefore, its always worth a try to call the API directly so that you do not need to rely on the wrapper.

Questions?

If you have questions, want to use this, make it better - please do! Find me either on twitter or on GitHub

sharing is caring

Published on:

Learn more
Luise Freese: Consultant & MVP
Luise Freese: Consultant & MVP

Recent content on Luise Freese: Consultant & MVP

Share post:

Related posts

Increasing Security for SQL Server Enabled by Azure Arc

Back in November 2023, the least privileges deployment model was introduced as a public preview. After thorough testing, we are excited to ann...

20 hours ago

Govern your Azure Firewall configuration with Azure Policies

Introduction:  In the rapidly evolving digital landscape, securing cloud environments is more critical than ever. Azure Firewall emerges ...

1 day ago

Azure Verified Modules - Monthly Update [June]

AVM Module Summary The AVM team are excited that our community have been busy building AVM Modules. As of June 17th, the AVM Footprint curren...

1 day ago

General Availability Announcement: Azure VM Regional to Zonal Move

Today, we announce the general availability of the capability to convert regional VMs to a zonal configuration within the same region. Th...

2 days ago

Azure WAF Public Preview: JavaScript Challenge

Microsoft has recently released JavaScript challenge in public preview for Azure WAF on Application Gateway and Azure Front Door.   Appro...

2 days ago

Public Preview Announcement: Azure Policy Built-in Versioning

Welcome to a new era of policy management, where policy definitions are more agile, adaptable, and accessible than ever before! We are thrille...

3 days ago
Stay up to date with latest Microsoft Dynamics 365 and Power Platform news!
* Yes, I agree to the privacy policy