Welcome back to another Logic Apps Best Practices, Tips, and Tricks post. Today, we’ll focus on a practical governance scenario and explore how you can apply workflow locks to Logic Apps Consumption using Visual Studio Logic App projects. By doing so, you can better protect your workflows from accidental changes while maintaining a consistent and controlled deployment process.
📝 One-Minute Brief
Azure Logic Apps Consumption workflows can also be protected from accidental changes by applying resource locks during deployment. This article shows how to apply read‑only locks to Logic Apps Consumption workflows using ARM templates in Visual Studio, enabling better governance, deployment consistency, and protection of production integrations without impacting runtime execution.
How to apply workflow Locks to Logic App Consumption in Visual Studio Logic App projects
Did you know that you can apply a lock directly to your Logic App by using an ARM (Azure Resource Manager) template in Visual Studio? With this approach, you can protect your Logic App from accidental deletion or unwanted changes. At the same time, you avoid locking the entire resource group. All configuration happens directly inside the LogicApp.json file, making the process simple and controlled.
How locks work
When you create a Logic Apps Consumption project in Visual Studio, you can define a lock resource directly in the LogicApp.json file, which contains the ARM template. As a result, Visual Studio deploys the lock together with the Logic App. This approach ensures that the workflow remains protected from accidental deletion or changes from the moment you create it.
The following example shows how you define the lock within the ARM template:
{
"type": "Microsoft.Authorization/locks",
"apiVersion": "2016-09-01",
"name": "Lock-For-LogicApp",
"properties": {
"level": "CanNotDelete",
"notes": "Lock applied to prevent accidental deletion"
},
"dependsOn": [
"[resourceId('Microsoft.Logic/workflows', parameters('logicAppName'))]"
],
"scope": "[concat(resourceGroup().id, '/providers/Microsoft.Logic/workflows/', parameters('logicAppName'))]"
}Let’s break down the key components:
- Type: Microsoft.Authorization/locks indicate that this is a lock resource.
- Name: Lock-For-LogicApp is a descriptive name for the lock.
- Properties:
- level: Set to CanNotDelete to prevent accidental deletion. You could also use ReadOnly to prevent any modifications.
- notes: A description of why the lock is applied.
- DependsOn: Ensures that the Logic App is created before the lock is applied.
- Scope: This crucial part targets the lock to the specific Logic App. It uses resourceGroup().id to get the current resource group, then appends the path to the Logic App resource.
What are the benefits of this approach?
We may say that these are some of the benefits of the lock approach:
- Integrated Protection: The lock is part of your Logic App’s ARM template, ensuring it’s always deployed with the app.
- Visual Studio Integration: You can manage the lock directly in your Visual Studio project.
- Version Control: The lock is versioned alongside your Logic App definition in source control.
- Consistency: Ensures the lock is applied consistently when the Logic App is deployed, preventing oversights.
How to implement locks through a Logic App Consumption Visual Studio project?
To implement this approach inside the Visual Studio project, you need to:
- Open your Logic App project in Visual Studio.
- In the Solution Explorer, find and open the LogicApp.json file.
- Locate the resources array in the JSON file.
- Add the lock resource definition (as shown) to the resources array.
- Adjust the name and notes as needed for your specific use case.
- Ensure the dependsOn array correctly references your Logic App resource.
- Save the file and deploy your Logic App as usual – the lock will be created along with your Logic App.
- You can also create a lock for the entire resource group.
Considerations
- Users with appropriate permissions can still remove the lock if necessary.
- If you need to update or delete the Logic App, you’ll need to remove the lock first.
- Consider using parameters for the lock name or level to make your template more flexible.
By using this method in Visual Studio, you can ensure that your critical Logic Apps are protected from accidental changes or deletion, adding an extra layer of safety to your Azure resources directly from your development environment.
Learn how to apply read-only locks to Azure Logic Apps Consumption workflows using ARM templates in Visual Studio to prevent accidental changes.
Hope you find this helpful! If you liked the content or found it useful and would like to support me in writing more, consider buying (or helping to buy) a Star Wars Lego set for my son.
