In Logic Apps Standard, most production problems that are not workflow bugs are connection problems: a credential that differs per environment, a connection that only one team was supposed to use, an endpoint that anyone with the URL can call, or an on-premises database that suddenly needs a gateway. This guide covers the connection model of Logic Apps Standard and three capabilities that matter for running it at scale: dynamic connection properties, Easy Auth deployed through CI/CD, and the Oracle Database connectors.

The connection model in one table

All workflows in a Standard logic app share connections.json. Keep environment-specific values out of it by referencing app settings (@appsetting('...')), keep secrets in Key Vault through Key Vault references, and deploy infrastructure and workflow code in separate pipeline stages, because workflows change much more often than the infrastructure underneath.

For managed connections shared between logic apps, use access policies so each logic app’s managed identity gets access only to the connections it needs. The Azure CLI logicapp extension can create and wire managed connections, for example with managed identity:

az logicapp connection managed create -g rg-integration-prd \
  --logic-app-name la-orders-prd -n blob-orders \
  --connector azureblob -l westeurope --auth-mode managed-identity

Dynamic connection properties

A long-standing limitation of Standard workflows was that a built-in connector action was bound to one connection. A workflow shared by several teams or tenants had to be duplicated, or used hard-coded connections. Logic Apps Standard now supports dynamic connection names for built-in (service provider) connectors, so the connection used by an action can be chosen at runtime.

That is powerful for multi-tenant designs and equally easy to misuse. Rules I apply:

1. Resolve the connection in one place – a lookup step or parameter at the start of the workflow, not scattered expressions in every action.
2. Validate the input – the value that selects a connection must come from a trusted source or be checked against an allowlist. A tenant ID from a request body is not a trusted source by itself.
3. Log the selected connection name (never its secret) so a run can be traced to the target it touched.
4. Name connections predictably, for example by tenant or business unit, so lookups stay simple and readable.

Easy Auth: protect HTTP-triggered workflows with Entra ID

Because Logic Apps Standard runs on the Azure Functions and App Service foundation, it supports Easy Auth (App Service Authentication). With Easy Auth, callers present a Microsoft Entra ID bearer token, and you can restrict which identities may call the workflows – for example, only the managed identity of your API Management instance. Microsoft also recommends Easy Auth for conversational agent workflows, where it provides a validated identity per caller, lets you assign connections per user and enforces Conditional Access.

A Bicep sketch of the configuration:

resource auth 'Microsoft.Web/sites/config@2023-01-01' = {
  name: 'authsettingsV2'
  parent: logicApp
  properties: {
    platform: { enabled: true }
    globalValidation: {
      requireAuthentication: true
      unauthenticatedClientAction: 'Return401'
    }
    identityProviders: {
      azureActiveDirectory: {
        enabled: true
        registration: {
          openIdIssuer: 'https://sts.windows.net/${tenant().tenantId}/v2.0'
          clientId: appRegistrationClientId
        }
        validation: {
          allowedAudiences: [ 'api://${appRegistrationClientId}' ]
          defaultAuthorizationPolicy: {
            allowedPrincipals: {
              identities: [ apimPrincipalId ]
            }
          }
        }
      }
    }
  }
}

The CI/CD trap

Easy Auth stores part of its configuration in the logic app’s app settings, such as WEBSITE_AUTH_ENABLED, WEBSITE_AUTH_DEFAULT_PROVIDER and MICROSOFT_PROVIDER_AUTHENTICATION_SECRET. A pipeline that overwrites the complete app settings collection on every deployment can silently remove them and switch authentication off. Manage these settings in the same infrastructure-as-code that defines Easy Auth, or merge app settings instead of replacing them, and add a post-deployment check that an unauthenticated call returns 401.

Also note the permissions: setting up Easy Auth requires the Azure Contributor role, not just the Logic Apps Standard Contributor role.

Oracle Database: built-in or managed connector

Oracle remains a common system of record behind integration workloads. Logic Apps now offers two connectors:

The built-in connector removes the gateway as a moving part, which is often the most fragile element of an Oracle integration. In exchange, networking becomes your responsibility: the logic app needs a route to the Oracle host and port, working DNS resolution and firewall rules – typically through VNet integration and a private connection to the data center. For the managed connector, set ORA_NCHAR_LITERAL_REPLACE to TRUE on the Oracle client to avoid data loss with NCHAR literals. Until the built-in connector reaches general availability, I would use it for new, non-critical workloads and keep existing production flows on the managed connector.

Bringing existing integration workloads to Standard

Many of these decisions come up during BizTalk Server migrations, where Logic Apps Standard is the usual target. Connection design deserves the same attention as map and schema migration; see Integration Account modernization, flat file schema generation and managed identity for Logic Apps Standard connectors.

Checklist

• No secrets in connections.json; app settings with Key Vault references.
• Access policies per logic app identity on shared managed connections.
• Dynamic connection selection centralized, validated and logged.
• Easy Auth defined in code; app settings merged, not replaced; 401 check after deployment.
• Oracle connector choice documented, including network path or gateway ownership.

Sources

• Set up Easy Auth for agent workflows in Azure Logic Apps
• Connect to Oracle Database from Azure Logic Apps
• az logicapp connection managed
• Demystifying Logic App Standard workflow deployments
• Logic Apps Aviators newsletter, July 2026 (dynamic connection properties)