Permissions

To support access and sharing resources with others, Azure Logic Apps Automation uses a permissions model based on resource scopes and roles. The platform also provides a separate ownership property on each resource. This article describes this model and common sharing scenarios.

High level summary

Aspect	Description
Resource owner	Each resource has a single owner and has an owner property independent from roles. The resource creator automatically becomes the owner.
Resource scopes	The following scopes work independently from each other: - Environment (organization) - App (content) - Sandbox (shared resources) For example, you can have a role on an environment, app, sandbox, or all these.
Roles	The following roles control the tasks that they can perform on resources: - Contributor (administrator) - Author (creator) - Reader (read only)
App visibility and privacy	Apps are private and invisible to other environment members unless you explicitly grant access.

Resource owner

Each resource has an Owner property with the following attributes:

Rule	Description
Set at creation	The resource creator is automatically the owner.
One owner per resource	Each resource, such as an environment, app, or sandbox, has only one owner.
Read only	The Owner property is read only.
Role-independent	Typically, the resource owner automatically gets the Contributor role. However, owner and contributor are separate, independent concepts.
Permitted actions	Resource owners can delete their own resources, including any resource contents they don’t own. For example, environment owners can delete their own environments along with any environment contents they don’t own. Note: Contributors alone can’t delete resources unless they’re also the owners.

Environment roles

The following table describes environment roles in detail:

Role	Allowed	Not allowed
Contributor	- View and edit environment settings. - Invite, update, and remove members. - Create apps and view apps (metadata only). - Create and edit sandbox configurations. Example: Can view app metadata such as the name, owner, and date. Note: Environment owners can delete any resources in their environment such as apps and sandboxes, including any they don’t own.	- Delete the environment as the owner. - Access app content without app-scoped permission. Example: Can’t access app content such as workflows, connections, and run history.
Author	- View environment settings and members. - Create and edit apps. - View, create, and edit sandbox configurations.	- Edit environment settings. - Manage other members. - View and access apps without app-scoped permission.
Reader	- View environment settings and members. - View sandbox configurations.	- Create, edit, or delete anything. - View any apps, which are automatically private. Note: If you have access to an app, you automatically get the Reader role on the parent environment. This role lets you view environment resources that the app needs.

For more information, see:

Environment members

The following table describes the best role to choose when you add environment members:

Member task	Role
Manage an environment, invite members, view all app metadata	Contributor
Create apps and shared resources	Author
Only view environment settings and shared resources	Reader

App roles

The following table describes app roles in detail:

Role	Allowed	Not allowed
Contributor	- View, create, and edit workflows, connections, and parameters. - View workflow run history. - Run, cancel, or resubmit workflow runs. - Delete workflows. - Manage app permissions.	Delete apps they don’t own.
Reader	- View workflows, connections, and parameters. - View workflow run history. Tip: Assign to app members for onboarding, demos, audits, and other tasks that don’t need edit access.	- Create, edit, or delete anything. - Run or cancel workflow runs. - Manage app permissions.

As a reminder, environment owners and those with environment-level Contributor roles can view all the apps and their metadata in an environment. Environment owners can delete any resource in their environments. However, environment owners and contributors can’t view, edit, or access workflow content, connections, and run history. This boundary lets administrators manage resources without viewing and accessing private data.
App members automatically get the environment-level Reader role so they can find environment-related resources. They can find the app in their Shared with you view.
By design, apps don’t have the Author role.

For more information, see:

App privacy and visibility

Apps often contain workflows that access and handle sensitive data. When you create an app, other environment members don’t automatically get the permissions to find, view, or access that app. For management and governance, environment owners and contributors can find and view your app metadata. They can’t view or access your app content.

This behavior makes sure that private data stays private unless you explicitly grant access. Only app owners and contributors can add others to an app by assigning the appropriate app-scoped role.

Orphaned apps

If an app owner leaves your organization, the app becomes orphaned with the following results:

The app’s Owner property shows that the owner is unknown or departed.
Existing members keep their access.
The app still appears in the environment’s apps list.
Only the environment owner can delete the app.

Sandbox roles

The following table describes sandbox roles in detail:

Role	Allowed	Not allowed
Contributor	- View and create sandboxes. - Edit and delete sandboxes they create and own.	Edit and delete sandboxes they don’t create or own.
Author	- View and create sandboxes. - Edit and delete sandboxes they create and own.	Edit and delete sandboxes they don’t create or own.
Reader	View sandboxes.	Create, edit, or delete sandboxes.

Environment owners can perform the following tasks on sandboxes:

Allowed	Not allowed
View, create, and delete sandboxes, including any they don’t create or own.	Edit any resource they don’t create or own.

Troubleshoot problems

Problem	Cause	Fix
”I can’t see any apps in the environment”	By default, apps are private.	Ask the app owner to add you to the app, or ask the environment owner to give you the environment-level Contributor role if you only need to view app metadata.
”I can’t create an app”	You have the environment Reader role.	Ask an environment Contributor to upgrade you to the Author or Contributor role.
”I can’t manage permissions on an app”	You need the app Contributor role.	Ask an app Contributor or the app Owner to manage permissions.
”I can’t delete an app”	Only the app Owner can delete an app.	Ask the app Owner or environment Owner to delete the app.
”I can’t trigger a workflow run”	You have the environment Reader role.	Ask an app Contributor to upgrade your role or trigger the run for you.
”I can’t delete my sandbox (shared resource)“	You’re not the sandbox creator. Only the creator can delete a shared resource.	Ask the sandbox creator or environment owner to delete the resource.