detection.wiki

Azure Logic Apps Azure-Microsoft.Logic

operationNameDescriptionSampleRule
anyCatch-all for Azure-Microsoft.Logic rules that match the resource provider but no specific operation.NN
Microsoft.Logic/automationProjects/applications/deleteDeletes the automation project application.NN
Microsoft.Logic/automationProjects/applications/writeWrites the automation project application.NN
Microsoft.Logic/automationProjects/deleteDeletes the automation project.NN
Microsoft.Logic/automationProjects/principals/writeWrites the automation project principal.NN
Microsoft.Logic/automationProjects/writeWrites the automation project.NN
Microsoft.Logic/businessprocesses/deleteDeletes the business process.NN
Microsoft.Logic/businessprocesses/developmentartifacts/validate/actionValidates the business process development artifact.NN
Microsoft.Logic/businessprocesses/developmentartifacts/writeWrites the business process development artifact.NN
Microsoft.Logic/businessprocesses/writeWrites the business process.NN
Microsoft.Logic/integrationAccounts/agreements/deleteDeletes the agreement in integration account.NN
Microsoft.Logic/integrationAccounts/agreements/listContentCallbackUrl/actionGets the callback URL for agreement content in integration account.NN
Microsoft.Logic/integrationAccounts/agreements/writeCreates or updates the agreement in integration account.NN
Microsoft.Logic/integrationAccounts/assemblies/deleteDeletes the assembly in integration account.NN
Microsoft.Logic/integrationAccounts/assemblies/listContentCallbackUrl/actionGets the callback URL for assembly content in integration account.NN
Microsoft.Logic/integrationAccounts/assemblies/writeCreates or updates the assembly in integration account.NN
Microsoft.Logic/integrationAccounts/batchConfigurations/deleteDeletes the batch configuration in integration account.NN
Microsoft.Logic/integrationAccounts/batchConfigurations/writeCreates or updates the batch configuration in integration account.NN
Microsoft.Logic/integrationAccounts/certificates/deleteDeletes the certificate in integration account.NN
Microsoft.Logic/integrationAccounts/certificates/writeCreates or updates the certificate in integration account.NN
Microsoft.Logic/integrationAccounts/deleteDeletes the integration account.NN
Microsoft.Logic/integrationAccounts/groups/deleteDeletes the group in integration account.NN
Microsoft.Logic/integrationAccounts/groups/writeCreates or updates the group in integration account.NN
Microsoft.Logic/integrationAccounts/join/actionJoins the Integration Account.NN
Microsoft.Logic/integrationAccounts/listCallbackUrl/actionGets the callback URL for integration account.NN
Microsoft.Logic/integrationAccounts/listKeyVaultKeys/actionGets the keys in the key vault.NN
Microsoft.Logic/integrationAccounts/logTrackingEvents/actionLogs the tracking events in the integration account.NN
Microsoft.Logic/integrationAccounts/maps/deleteDeletes the map in integration account.NN
Microsoft.Logic/integrationAccounts/maps/listContentCallbackUrl/actionGets the callback URL for map content in integration account.NN
Microsoft.Logic/integrationAccounts/maps/writeCreates or updates the map in integration account.NN
Microsoft.Logic/integrationAccounts/partners/deleteDeletes the partner in integration account.NN
Microsoft.Logic/integrationAccounts/partners/listContentCallbackUrl/actionGets the callback URL for partner content in integration account.NN
Microsoft.Logic/integrationAccounts/partners/writeCreates or updates the partner in integration account.NN
Microsoft.Logic/integrationAccounts/privateEndpointConnectionProxies/deleteDeletes the Private Endpoint Connection Proxies.NN
Microsoft.Logic/integrationAccounts/privateEndpointConnectionProxies/validate/actionValidates the Private Endpoint Connection Proxies.NN
Microsoft.Logic/integrationAccounts/privateEndpointConnectionProxies/writeCreates or Updates the Private Endpoint Connection Proxies.NN
Microsoft.Logic/integrationAccounts/regenerateAccessKey/actionRegenerates the access key secrets.NN
Microsoft.Logic/integrationAccounts/rosettaNetProcessConfigurations/deleteDeletes the RosettaNet process configuration in integration account.NN
Microsoft.Logic/integrationAccounts/rosettaNetProcessConfigurations/writeCreates or updates the RosettaNet process configuration in integration account.NN
Microsoft.Logic/integrationAccounts/schedules/deleteDeletes the schedule in integration account.NN
Microsoft.Logic/integrationAccounts/schedules/writeCreates or updates the schedule in integration account.NN
Microsoft.Logic/integrationAccounts/schemas/deleteDeletes the schema in integration account.NN
Microsoft.Logic/integrationAccounts/schemas/listContentCallbackUrl/actionGets the callback URL for schema content in integration account.NN
Microsoft.Logic/integrationAccounts/schemas/writeCreates or updates the schema in integration account.NN
Microsoft.Logic/integrationAccounts/sessions/deleteDeletes the session in integration account.NN
Microsoft.Logic/integrationAccounts/sessions/writeCreates or updates the session in integration account.NN
Microsoft.Logic/integrationAccounts/usageConfigurations/deleteDeletes the usage configuration in integration account.NN
Microsoft.Logic/integrationAccounts/usageConfigurations/listCallbackUrl/actionGets the callback URL for the usage configuration in integration account.NN
Microsoft.Logic/integrationAccounts/usageConfigurations/writeCreates or updates the usage configuration in integration account.NN
Microsoft.Logic/integrationAccounts/writeCreates or updates the integration account.NN
Microsoft.Logic/integrationServiceEnvironments/deleteDeletes the integration service environment.NN
Microsoft.Logic/integrationServiceEnvironments/join/actionJoins the Integration Service Environment.NN
Microsoft.Logic/integrationServiceEnvironments/managedApis/join/actionJoins the Integration Service Environment Managed API.NN
Microsoft.Logic/integrationServiceEnvironments/managedApis/writeCreates or updates the integration service environment managed API.NN
Microsoft.Logic/integrationServiceEnvironments/writeCreates or updates the integration service environment.NN
Microsoft.Logic/locations/workflows/recommendOperationGroups/actionGets the workflow recommend operation groups.NN
Microsoft.Logic/locations/workflows/validate/actionValidates the workflow.NN
Microsoft.Logic/register/actionRegisters the Microsoft.Logic resource provider for a given subscription.NN
Microsoft.Logic/templates/deleteDeletes the flow organization template.NN
Microsoft.Logic/templates/writeWrites the flow organization template.NN
Microsoft.Logic/workflows/accessKeys/deleteDeletes the access key.NN
Microsoft.Logic/workflows/accessKeys/list/actionLists the access key secrets.NN
Microsoft.Logic/workflows/accessKeys/regenerate/actionRegenerates the access key secrets.NN
Microsoft.Logic/workflows/accessKeys/writeCreates or updates the access key.NN
Microsoft.Logic/workflows/clone/actionClones a workflow.NN
Microsoft.Logic/workflows/deleteDeletes the workflow.YN
Microsoft.Logic/workflows/disable/actionDisables the workflow.NN
Microsoft.Logic/workflows/enable/actionEnables the workflow.NN
Microsoft.Logic/workflows/listCallbackUrl/actionGets the callback URL for workflow.NN
Microsoft.Logic/workflows/listSwagger/actionGets the workflow swagger definitions.NN
Microsoft.Logic/workflows/move/actionMoves Workflow from its existing subscription id, resource group, and/or name to a different subscription id, resource group, and/or name.NN
Microsoft.Logic/workflows/providers/Microsoft.Insights/diagnosticSettings/writeCreates or updates the workflow diagnostic setting.NN
Microsoft.Logic/workflows/regenerateAccessKey/actionRegenerates the access key secrets.NN
Microsoft.Logic/workflows/run/actionStarts a run of the workflow.NN
Microsoft.Logic/workflows/runs/actions/listExpressionTraces/actionGets the workflow run action expression traces.NN
Microsoft.Logic/workflows/runs/actions/repetitions/listExpressionTraces/actionGets the workflow run action repetition expression traces.NN
Microsoft.Logic/workflows/runs/cancel/actionCancels the run of a workflow.NN
Microsoft.Logic/workflows/runs/deleteDeletes a run of a workflow.NN
Microsoft.Logic/workflows/suspend/actionSuspends the workflow.NN
Microsoft.Logic/workflows/triggers/histories/resubmit/actionResubmits the workflow trigger.NN
Microsoft.Logic/workflows/triggers/listCallbackUrl/actionGets the callback URL for trigger.NN
Microsoft.Logic/workflows/triggers/reset/actionResets the trigger.NN
Microsoft.Logic/workflows/triggers/run/actionExecutes the trigger.NN
Microsoft.Logic/workflows/triggers/setState/actionSets the trigger state.NN
Microsoft.Logic/workflows/validate/actionValidates the workflow.NN
Microsoft.Logic/workflows/validateclone/actionValidates the clone operation on a workflow.NN
Microsoft.Logic/workflows/versions/triggers/listCallbackUrl/actionGets the callback URL for trigger.NN
Microsoft.Logic/workflows/writeCreates or updates the workflow.YN
Microsoft.Logic/integrationAccounts/agreements/listSecrets/actionList Integration Account Agreement SecretsNN

any: Azure Logic Apps (catch-all)

#
Namespace
Microsoft.Logic

Description

Catch-all for Azure-Microsoft.Logic rules that match the resource provider but no specific operation.

References #

Microsoft.Logic/automationProjects/applications/delete

#
Namespace
Microsoft.Logic

Description

Deletes the automation project application.

References #

Microsoft.Logic/automationProjects/applications/write

#
Namespace
Microsoft.Logic

Description

Writes the automation project application.

References #

Microsoft.Logic/automationProjects/delete

#
Namespace
Microsoft.Logic

Description

Deletes the automation project.

References #

Microsoft.Logic/automationProjects/principals/write

#
Namespace
Microsoft.Logic

Description

Writes the automation project principal.

References #

Microsoft.Logic/automationProjects/write

#
Namespace
Microsoft.Logic

Description

Writes the automation project.

References #

Microsoft.Logic/businessprocesses/delete

#
Namespace
Microsoft.Logic

Description

Deletes the business process.

References #

Microsoft.Logic/businessprocesses/developmentartifacts/validate/action

#
Namespace
Microsoft.Logic

Description

Validates the business process development artifact.

References #

Microsoft.Logic/businessprocesses/developmentartifacts/write

#
Namespace
Microsoft.Logic

Description

Writes the business process development artifact.

References #

Microsoft.Logic/businessprocesses/write

#
Namespace
Microsoft.Logic

Description

Writes the business process.

References #

Microsoft.Logic/integrationAccounts/agreements/delete

#
Namespace
Microsoft.Logic

Description

Deletes the agreement in integration account.

References #

Microsoft.Logic/integrationAccounts/agreements/listContentCallbackUrl/action

#
Namespace
Microsoft.Logic

Description

Gets the callback URL for agreement content in integration account.

References #

Microsoft.Logic/integrationAccounts/agreements/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the agreement in integration account.

References #

Microsoft.Logic/integrationAccounts/assemblies/delete

#
Namespace
Microsoft.Logic

Description

Deletes the assembly in integration account.

References #

Microsoft.Logic/integrationAccounts/assemblies/listContentCallbackUrl/action

#
Namespace
Microsoft.Logic

Description

Gets the callback URL for assembly content in integration account.

References #

Microsoft.Logic/integrationAccounts/assemblies/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the assembly in integration account.

References #

Microsoft.Logic/integrationAccounts/batchConfigurations/delete

#
Namespace
Microsoft.Logic

Description

Deletes the batch configuration in integration account.

References #

Microsoft.Logic/integrationAccounts/batchConfigurations/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the batch configuration in integration account.

References #

Microsoft.Logic/integrationAccounts/certificates/delete

#
Namespace
Microsoft.Logic

Description

Deletes the certificate in integration account.

References #

Microsoft.Logic/integrationAccounts/certificates/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the certificate in integration account.

References #

Microsoft.Logic/integrationAccounts/delete

#
Namespace
Microsoft.Logic

Description

Deletes the integration account.

References #

Microsoft.Logic/integrationAccounts/groups/delete

#
Namespace
Microsoft.Logic

Description

Deletes the group in integration account.

References #

Microsoft.Logic/integrationAccounts/groups/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the group in integration account.

References #

Microsoft.Logic/integrationAccounts/join/action

#
Namespace
Microsoft.Logic

Description

Joins the Integration Account.

References #

Microsoft.Logic/integrationAccounts/listCallbackUrl/action

#
Namespace
Microsoft.Logic

Description

Gets the callback URL for integration account.

References #

Microsoft.Logic/integrationAccounts/listKeyVaultKeys/action

#
Namespace
Microsoft.Logic

Description

Gets the keys in the key vault.

References #

Microsoft.Logic/integrationAccounts/logTrackingEvents/action

#
Namespace
Microsoft.Logic

Description

Logs the tracking events in the integration account.

References #

Microsoft.Logic/integrationAccounts/maps/delete

#
Namespace
Microsoft.Logic

Description

Deletes the map in integration account.

References #

Microsoft.Logic/integrationAccounts/maps/listContentCallbackUrl/action

#
Namespace
Microsoft.Logic

Description

Gets the callback URL for map content in integration account.

References #

Microsoft.Logic/integrationAccounts/maps/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the map in integration account.

References #

Microsoft.Logic/integrationAccounts/partners/delete

#
Namespace
Microsoft.Logic

Description

Deletes the partner in integration account.

References #

Microsoft.Logic/integrationAccounts/partners/listContentCallbackUrl/action

#
Namespace
Microsoft.Logic

Description

Gets the callback URL for partner content in integration account.

References #

Microsoft.Logic/integrationAccounts/partners/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the partner in integration account.

References #

Microsoft.Logic/integrationAccounts/privateEndpointConnectionProxies/delete

#
Namespace
Microsoft.Logic

Description

Deletes the Private Endpoint Connection Proxies.

References #

Microsoft.Logic/integrationAccounts/privateEndpointConnectionProxies/validate/action

#
Namespace
Microsoft.Logic

Description

Validates the Private Endpoint Connection Proxies.

References #

Microsoft.Logic/integrationAccounts/privateEndpointConnectionProxies/write

#
Namespace
Microsoft.Logic

Description

Creates or Updates the Private Endpoint Connection Proxies.

References #

Microsoft.Logic/integrationAccounts/regenerateAccessKey/action

#
Namespace
Microsoft.Logic

Description

Regenerates the access key secrets.

References #

Microsoft.Logic/integrationAccounts/rosettaNetProcessConfigurations/delete

#
Namespace
Microsoft.Logic

Description

Deletes the RosettaNet process configuration in integration account.

References #

Microsoft.Logic/integrationAccounts/rosettaNetProcessConfigurations/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the RosettaNet process configuration in integration account.

References #

Microsoft.Logic/integrationAccounts/schedules/delete

#
Namespace
Microsoft.Logic

Description

Deletes the schedule in integration account.

References #

Microsoft.Logic/integrationAccounts/schedules/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the schedule in integration account.

References #

Microsoft.Logic/integrationAccounts/schemas/delete

#
Namespace
Microsoft.Logic

Description

Deletes the schema in integration account.

References #

Microsoft.Logic/integrationAccounts/schemas/listContentCallbackUrl/action

#
Namespace
Microsoft.Logic

Description

Gets the callback URL for schema content in integration account.

References #

Microsoft.Logic/integrationAccounts/schemas/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the schema in integration account.

References #

Microsoft.Logic/integrationAccounts/sessions/delete

#
Namespace
Microsoft.Logic

Description

Deletes the session in integration account.

References #

Microsoft.Logic/integrationAccounts/sessions/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the session in integration account.

References #

Microsoft.Logic/integrationAccounts/usageConfigurations/delete

#
Namespace
Microsoft.Logic

Description

Deletes the usage configuration in integration account.

References #

Microsoft.Logic/integrationAccounts/usageConfigurations/listCallbackUrl/action

#
Namespace
Microsoft.Logic

Description

Gets the callback URL for the usage configuration in integration account.

References #

Microsoft.Logic/integrationAccounts/usageConfigurations/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the usage configuration in integration account.

References #

Microsoft.Logic/integrationAccounts/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the integration account.

References #

Microsoft.Logic/integrationServiceEnvironments/delete

#
Namespace
Microsoft.Logic

Description

Deletes the integration service environment.

References #

Microsoft.Logic/integrationServiceEnvironments/join/action

#
Namespace
Microsoft.Logic

Description

Joins the Integration Service Environment.

References #

Microsoft.Logic/integrationServiceEnvironments/managedApis/join/action

#
Namespace
Microsoft.Logic

Description

Joins the Integration Service Environment Managed API.

References #

Microsoft.Logic/integrationServiceEnvironments/managedApis/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the integration service environment managed API.

References #

Microsoft.Logic/integrationServiceEnvironments/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the integration service environment.

References #

Microsoft.Logic/locations/workflows/recommendOperationGroups/action

#
Namespace
Microsoft.Logic

Description

Gets the workflow recommend operation groups.

References #

Microsoft.Logic/locations/workflows/validate/action

#
Namespace
Microsoft.Logic

Description

Validates the workflow.

References #

Microsoft.Logic/register/action

#
Namespace
Microsoft.Logic

Description

Registers the Microsoft.Logic resource provider for a given subscription.

References #

Microsoft.Logic/templates/delete

#
Namespace
Microsoft.Logic

Description

Deletes the flow organization template.

References #

Microsoft.Logic/templates/write

#
Namespace
Microsoft.Logic

Description

Writes the flow organization template.

References #

Microsoft.Logic/workflows/accessKeys/delete

#
Namespace
Microsoft.Logic

Description

Deletes the access key.

References #

Microsoft.Logic/workflows/accessKeys/list/action

#
Namespace
Microsoft.Logic

Description

Lists the access key secrets.

References #

Microsoft.Logic/workflows/accessKeys/regenerate/action

#
Namespace
Microsoft.Logic

Description

Regenerates the access key secrets.

References #

Microsoft.Logic/workflows/accessKeys/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the access key.

References #

Microsoft.Logic/workflows/clone/action

#
Namespace
Microsoft.Logic

Description

Clones a workflow.

References #

Microsoft.Logic/workflows/delete

#
Namespace
Microsoft.Logic

Description

Deletes the workflow.

Example Resource Log Record #

{
  "TenantId": "7c759f10-811c-4db8-ad6d-f07d8ae3f8ea",
  "SourceSystem": "Azure",
  "CallerIpAddress": "37.142.150.162",
  "CategoryValue": "Administrative",
  "CorrelationId": "84fcb0a6-91db-4f09-a74e-97d1d41f2c6f",
  "Authorization": {
    "scope": "/subscriptions/8f153238-e602-427e-a7c0-3043fbe50918/resourceGroups/EY_Demo",
    "action": "Microsoft.Resources/subscriptions/resourceGroups/delete",
    "evidence": {
      "role": "Contributor",
      "roleAssignmentScope": "/subscriptions/8f153238-e602-427e-a7c0-3043fbe50918",
      "roleAssignmentId": "9ddc3bf8125f4918ad9f9dd31a0ae60f",
      "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c",
      "principalId": "9b117c67170e4aed9702658b3fddc889",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/8f153238-e602-427e-a7c0-3043fbe50918/resourceGroups/EY_Demo",
    "action": "Microsoft.Resources/subscriptions/resourceGroups/delete",
    "evidence": {
      "role": "Contributor",
      "roleAssignmentScope": "/subscriptions/8f153238-e602-427e-a7c0-3043fbe50918",
      "roleAssignmentId": "9ddc3bf8125f4918ad9f9dd31a0ae60f",
      "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c",
      "principalId": "9b117c67170e4aed9702658b3fddc889",
      "principalType": "User"
    }
  },
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/2ad3fc79-1859-42fa-9011-6f8df2251b22/",
    "iat": "1619620278",
    "nbf": "1619620278",
    "exp": "1619624178",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "aio": "ATQAy/8TAAAA7zVpz1MTiN5PcZ84YU7VvUqYvGDj8M8XljPirr2ynbiIAMHm6UVn78uuUS6hpfLV",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd",
    "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
    "appidacr": "2",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Vance",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Adele",
    "groups": "b8ebf801-537d-4ef0-9353-545d8b161a4c,4dee65d3-7474-4a57-b550-19b1435e6fdc,dc8c1d8a-5cbe-4db7-a252-ed6e77a9bac6,72d050bc-1235-43d2-be81-4029fbfbd6c7,0d569539-ca8f-4e1b-bfbd-35e57b0d4bf1,8041dfc5-efef-4035-8241-74179adf4b9f",
    "ipaddr": "37.142.150.162",
    "name": "Adele Vance",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "9b117c67-170e-4aed-9702-658b3fddc889",
    "puid": "10032000C757D25F",
    "rh": "0.AVIAefzTKlkY-kKQEW-N8iUbIoNAS8SwO8FJtH2XTlPL3zxSAJg.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "ZkJagYHGZD8_R8qCe2VRG3nD8dGJehXAuGi58QDeOtM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "2ad3fc79-1859-42fa-9011-6f8df2251b22",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "AdeleV@M365x816222.OnMicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "AdeleV@M365x816222.OnMicrosoft.com",
    "uti": "H9u_0K6Ph0a_X_ZpaCFwAQ",
    "ver": "1.0",
    "xms_tcdt": "1591748537"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/2ad3fc79-1859-42fa-9011-6f8df2251b22/",
    "iat": "1619620278",
    "nbf": "1619620278",
    "exp": "1619624178",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "aio": "ATQAy/8TAAAA7zVpz1MTiN5PcZ84YU7VvUqYvGDj8M8XljPirr2ynbiIAMHm6UVn78uuUS6hpfLV",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd",
    "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
    "appidacr": "2",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Vance",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Adele",
    "groups": "b8ebf801-537d-4ef0-9353-545d8b161a4c,4dee65d3-7474-4a57-b550-19b1435e6fdc,dc8c1d8a-5cbe-4db7-a252-ed6e77a9bac6,72d050bc-1235-43d2-be81-4029fbfbd6c7,0d569539-ca8f-4e1b-bfbd-35e57b0d4bf1,8041dfc5-efef-4035-8241-74179adf4b9f",
    "ipaddr": "37.142.150.162",
    "name": "Adele Vance",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "9b117c67-170e-4aed-9702-658b3fddc889",
    "puid": "10032000C757D25F",
    "rh": "0.AVIAefzTKlkY-kKQEW-N8iUbIoNAS8SwO8FJtH2XTlPL3zxSAJg.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "ZkJagYHGZD8_R8qCe2VRG3nD8dGJehXAuGi58QDeOtM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "2ad3fc79-1859-42fa-9011-6f8df2251b22",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "AdeleV@M365x816222.OnMicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "AdeleV@M365x816222.OnMicrosoft.com",
    "uti": "H9u_0K6Ph0a_X_ZpaCFwAQ",
    "ver": "1.0",
    "xms_tcdt": "1591748537"
  },
  "OperationNameValue": "MICROSOFT.LOGIC/WORKFLOWS/DELETE",
  "Properties": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/8f153238-e602-427e-a7c0-3043fbe50918/resourcegroups/EY_Demo/providers/Microsoft.Logic/workflows/Sentinel-Ingest-AAD-SignInLog",
    "message": "Microsoft.Logic/workflows/delete",
    "hierarchy": "2ad3fc79-1859-42fa-9011-6f8df2251b22/CONTOSO-MG/8f153238-e602-427e-a7c0-3043fbe50918",
    "caller": "AdeleV@M365x816222.OnMicrosoft.com",
    "eventDataId": "7213d612-94b6-4ddb-856f-bb723409f48c",
    "eventSubmissionTimestamp": "2021-04-28T14:44:22.9477862Z",
    "httpRequest": {
      "clientIpAddress": "37.142.150.162"
    },
    "resource": "sentinel-ingest-aad-signinlog",
    "resourceGroup": "EY_DEMO",
    "resourceProviderValue": "MICROSOFT.LOGIC",
    "subscriptionId": "8F153238-E602-427E-A7C0-3043FBE50918",
    "activityStatusValue": "Success"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/8f153238-e602-427e-a7c0-3043fbe50918/resourcegroups/EY_Demo/providers/Microsoft.Logic/workflows/Sentinel-Ingest-AAD-SignInLog",
    "message": "Microsoft.Logic/workflows/delete",
    "hierarchy": "2ad3fc79-1859-42fa-9011-6f8df2251b22/CONTOSO-MG/8f153238-e602-427e-a7c0-3043fbe50918",
    "caller": "AdeleV@M365x816222.OnMicrosoft.com",
    "eventDataId": "7213d612-94b6-4ddb-856f-bb723409f48c",
    "eventSubmissionTimestamp": "2021-04-28T14:44:22.9477862Z",
    "httpRequest": {
      "clientIpAddress": "37.142.150.162"
    },
    "resource": "sentinel-ingest-aad-signinlog",
    "resourceGroup": "EY_DEMO",
    "resourceProviderValue": "MICROSOFT.LOGIC",
    "subscriptionId": "8f153238-e602-427e-a7c0-3043fbe50918",
    "activityStatusValue": "Success"
  },
  "Caller": "AdeleV@M365x816222.OnMicrosoft.com",
  "EventDataId": "7213d612-94b6-4ddb-856f-bb723409f48c",
  "EventSubmissionTimestamp": "4/28/2021, 2:44:22.947 PM",
  "HTTPRequest": {
    "clientIpAddress": "37.142.150.162"
  },
  "ResourceGroup": "EY_DEMO",
  "ResourceProviderValue": "MICROSOFT.LOGIC",
  "ActivityStatusValue": "Success",
  "Hierarchy": "2ad3fc79-1859-42fa-9011-6f8df2251b22/CONTOSO-MG/8f153238-e602-427e-a7c0-3043fbe50918",
  "TimeGenerated": "4/28/2021, 2:44:22.947 PM",
  "SubscriptionId": "8f153238-e602-427e-a7c0-3043fbe50918",
  "Type": "AzureActivity"
}

References #

Microsoft.Logic/workflows/disable/action

#
Namespace
Microsoft.Logic

Description

Disables the workflow.

References #

Microsoft.Logic/workflows/enable/action

#
Namespace
Microsoft.Logic

Description

Enables the workflow.

References #

Microsoft.Logic/workflows/listCallbackUrl/action

#
Namespace
Microsoft.Logic

Description

Gets the callback URL for workflow.

References #

Microsoft.Logic/workflows/listSwagger/action

#
Namespace
Microsoft.Logic

Description

Gets the workflow swagger definitions.

References #

Microsoft.Logic/workflows/move/action

#
Namespace
Microsoft.Logic

Description

Moves Workflow from its existing subscription id, resource group, and/or name to a different subscription id, resource group, and/or name.

References #

Microsoft.Logic/workflows/providers/Microsoft.Insights/diagnosticSettings/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the workflow diagnostic setting.

References #

Microsoft.Logic/workflows/regenerateAccessKey/action

#
Namespace
Microsoft.Logic

Description

Regenerates the access key secrets.

References #

Microsoft.Logic/workflows/run/action

#
Namespace
Microsoft.Logic

Description

Starts a run of the workflow.

References #

Microsoft.Logic/workflows/runs/actions/listExpressionTraces/action

#
Namespace
Microsoft.Logic

Description

Gets the workflow run action expression traces.

References #

Microsoft.Logic/workflows/runs/actions/repetitions/listExpressionTraces/action

#
Namespace
Microsoft.Logic

Description

Gets the workflow run action repetition expression traces.

References #

Microsoft.Logic/workflows/runs/cancel/action

#
Namespace
Microsoft.Logic

Description

Cancels the run of a workflow.

References #

Microsoft.Logic/workflows/runs/delete

#
Namespace
Microsoft.Logic

Description

Deletes a run of a workflow.

References #

Microsoft.Logic/workflows/suspend/action

#
Namespace
Microsoft.Logic

Description

Suspends the workflow.

References #

Microsoft.Logic/workflows/triggers/histories/resubmit/action

#
Namespace
Microsoft.Logic

Description

Resubmits the workflow trigger.

References #

Microsoft.Logic/workflows/triggers/listCallbackUrl/action

#
Namespace
Microsoft.Logic

Description

Gets the callback URL for trigger.

References #

Microsoft.Logic/workflows/triggers/reset/action

#
Namespace
Microsoft.Logic

Description

Resets the trigger.

References #

Microsoft.Logic/workflows/triggers/run/action

#
Namespace
Microsoft.Logic

Description

Executes the trigger.

References #

Microsoft.Logic/workflows/triggers/setState/action

#
Namespace
Microsoft.Logic

Description

Sets the trigger state.

References #

Microsoft.Logic/workflows/validate/action

#
Namespace
Microsoft.Logic

Description

Validates the workflow.

References #

Microsoft.Logic/workflows/validateclone/action

#
Namespace
Microsoft.Logic

Description

Validates the clone operation on a workflow.

References #

Microsoft.Logic/workflows/versions/triggers/listCallbackUrl/action

#
Namespace
Microsoft.Logic

Description

Gets the callback URL for trigger.

References #

Microsoft.Logic/workflows/write

#
Namespace
Microsoft.Logic

Description

Creates or updates the workflow.

Example Resource Log Record #

{
  "ActivityStatusValue": "Failure",
  "ActivitySubstatusValue": "Conflict",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Logic/workflows/dwh2220afworkflows",
    "action": "Microsoft.Logic/workflows/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Logic/workflows/dwh2220afworkflows",
    "action": "Microsoft.Logic/workflows/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783012099",
    "nbf": "1783012099",
    "exp": "1783017701",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "eyUvMswr6EqJhPARR0x4AA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "5 3",
    "xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
    "xms_idrel": "24 1",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783012099",
    "nbf": "1783012099",
    "exp": "1783017701",
    "aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "idtyp": "user",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "uti": "eyUvMswr6EqJhPARR0x4AA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "5 3",
    "xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
    "xms_idrel": "24 1",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "puid": "1111111111111111",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
  },
  "CorrelationId": "1afcbbe3-df90-433d-b559-20f461fe3b8a",
  "EventDataId": "054a12ab-b07a-cee2-17d7-c27c5e11d8b2",
  "EventSubmissionTimestamp": "2026-07-02T18:28:41.3421783Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Error",
  "OperationNameValue": "MICROSOFT.LOGIC/WORKFLOWS/WRITE",
  "Properties": {
    "statusCode": "Conflict",
    "serviceRequestId": "",
    "statusMessage": {
      "error": {
        "code": "MissingSubscriptionRegistration",
        "message": "The subscription is not registered to use namespace 'Microsoft.Logic'. See https://aka.ms/rps-not-found for how to register subscriptions.",
        "details": [
          {
            "code": "MissingSubscriptionRegistration",
            "target": "Microsoft.Logic",
            "message": "The subscription is not registered to use namespace 'Microsoft.Logic'. See https://aka.ms/rps-not-found for how to register subscriptions."
          }
        ]
      }
    },
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Logic/workflows/dwh2220afworkflows",
    "message": "Microsoft.Logic/workflows/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "054a12ab-b07a-cee2-17d7-c27c5e11d8b2",
    "eventSubmissionTimestamp": "2026-07-02T18:28:41.3421783Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwh2220afworkflows",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.LOGIC",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Failure",
    "activitySubstatusValue": "Conflict"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Logic/workflows/dwh2220afworkflows",
    "message": "Microsoft.Logic/workflows/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "054a12ab-b07a-cee2-17d7-c27c5e11d8b2",
    "eventSubmissionTimestamp": "2026-07-02T18:28:41.3421783Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwh2220afworkflows",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.LOGIC",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Failure",
    "statusCode": "Conflict",
    "serviceRequestId": "",
    "activitySubstatusValue": "Conflict",
    "statusMessage": {
      "error": {
        "code": "MissingSubscriptionRegistration",
        "message": "The subscription is not registered to use namespace 'Microsoft.Logic'. See https://aka.ms/rps-not-found for how to register subscriptions.",
        "details": [
          {
            "code": "MissingSubscriptionRegistration",
            "target": "Microsoft.Logic",
            "message": "The subscription is not registered to use namespace 'Microsoft.Logic'. See https://aka.ms/rps-not-found for how to register subscriptions."
          }
        ]
      }
    }
  },
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceProviderValue": "MICROSOFT.LOGIC",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

References #

Microsoft.Logic/integrationAccounts/agreements/listSecrets/action

#
Namespace
Microsoft.Logic

Description

List Integration Account Agreement Secrets

References #