Integrating Azure Functions With Azure Logic App

Before jumping into the details of integrating Azure Functions within an Azure Logic App I would like to start by discussing the scenario that I was trying to implement. As shown in Figure 1 the request flows through an Azure APIM into the Logic App which in turn utilizes an Azure Function that utilizes an Azure Table Storage. When the Logic App gets triggered by the APIM it receives a custom header which includes an Azure AD role. The role is passed to the Azure Function which makes a decision on whether the Logic App is permitted to move forward with the call to the SAP system on-prem.

Note: At the time of writing this blog post Logic App inline code only supported JavaScript. In my case I am utilizing C# as the programming language of choice and thus I ended up utilizing an Azure Function.

Figure 1: High level architecture

Although the Azure AD and Azure APIM implementation is outside the scope of this blog post, let me briefly mention how the request arrives at the Logic App with an Azure AD role that is stored in a custom header as it will help us better understand the Azure Function implementation later on in this post. The APIM instance has an associated Azure AD application registration. As shown in Figure 2 the application registration lists different roles which are associated with different clients that will consume the APIM instance. Each client will have their Azure AD application registration and will ask for an api permission for a specific role. Figure 3 shows a client that asked for Client1 role. This means that in this example any request coming from this client will have the Client 1 “role” claim in their access token.

Figure 2: Azure AD roles associated with the APIM application registration in Azure AD

Figure 3: Azure AD Client1 application registration

Now that we understood how the request arrives at the Logic App lets start by discussing the Logic App implementation. As shown in Figure 4, when the Logic App is triggered (as an APIM backend) it starts by checking for the custom header which will include the Azure AD role. Once it confirms that the role exists then it will trigger the Azure Function which…