Introduction

A System Assigned Managed Identity (SAMI) is an Azure Enterprise Application created and managed by Azure with a certificate-based credential. SAMIs are intended for integration/automation and supported by most Azure resources including Azure Logic App. A SAMI enables the resource to access other Azure resources and applications via RBAC and API permissions without the need to manually store or retrieve the identity credential e.g., Azure Key Vault. The SAMI is tied to the resource and automatically deleted if the resource is deleted.

A SAMI is preferred to a ‘user’ or ‘registered application’ as there is no secret to manage in the integration/automation.

Reference:
Managed identities for Azure resources frequently asked questions” – Managed identities for Azure resources | Microsoft Learn

SAMI and Azure Logic Apps

The Logic App SAMI can be utilised directly with some ‘built-in’ Logic App actions. For actions that do not currently support SAMI, a HTTP action may be substituted.

One example of an action that doesn’t support SAMI is ‘Send an email from a shared mailbox (V2)’. This action is useful for sending an email from the ‘no-reply@csenergy.com.au’. The ‘no-reply’ email is typically a shared mailbox in the company Exchange Online tenant – a shared mailbox doesn’t require a license.

This approach can also be used to send from any company email e.g. user1@company.com.au.

Whilst the ‘Send an email from a shared mailbox (V2)’ action is easy to implement using a user-based credential i.e. authenticate in the portal to create the connection, the user-based credential creates a risk that the app may break when the user changes their password and forgets to update the Logic App connection.

The SAMI approach is more difficult to implement however provides a set-and-forget benefit i.e. requires no management of the connection.

Implementation

Step 1 – Create a System Assigned

Step 2 – Assign the ‘Mail.Send’ Microsoft Graph API permission
– This step must be completed by a Global Administrator using PowerShell

Connect-AzAccount
$samiName = 'cptlogicapp' # Name of system-assigned managed identity - same as Logic App name
$tenantId = 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx'
$samiSP = Get-AzADServicePrincipal -Filter "displayName eq '$samiName'"
$graphSP = Get-AzADServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$permission = 'Mail.Send' # send an email on behalf of another user
<# other roles
$permission = 'User.Read.All' # read user data from Entra
#>
$appRole = $graphSP.AppRole | Where-Object {($_.Value -in $permission) -and ($_.AllowedMemberType -contains "Application")}
Connect-MgGraph -Scopes 'Directory.ReadWrite.All','User.Read','Application.ReadWrite.All','AppRoleAssignment.ReadWrite.All','DelegatedPermissionGrant.ReadWrite.All'
$appRoleAssignment = @{
  "PrincipalId" = $samiSP.Id
  "ResourceId" = $graphSP.Id
  "AppRoleId" = $appRole.Id
}
New-MgServicePrincipalAppRoleAssignment `
  -ServicePrincipalId $appRoleAssignment.PrincipalId `
  -BodyParameter $appRoleAssignment `
  -Verbose

Step 3 – Add and Configure the HTTP Action

Search for the ‘HTTP’ action and add.

 Configure the HTTP ‘Authentication’ parameters.

 Configure the authentication with the audience: https://graph.microsoft.com

Complete the HTTP request parameters:

• URI: https://graph.microsoft.com/v1.0/users/no-reply@company.com.au/sendMail
• Method: POST
• Body: JSON payload

Example

{
  "message": {
    "subject": "Test Email",
    "body": {
      "contentType": "HTML",
      "content": null
    },
    "toRecipients": [
      {
        "emailAddress": {
          "address": "user@company.com"
        }
      }
    ]
  }
}

‘Save’ and ‘Run’ to test. View the ‘Run History’ for result.