/azure-logic-apps-standard-cli

name: azure-logic-apps-standard-cli
description: 'Create, inspect, validate, test, run, debug, package, and deploy Azure Logic Apps Standard projects using the Azure CLI logicapp extension. Use for Standard workflow authoring, optional workspaces, connector discovery, identity-based connections, local runtimes, native workflow tests, and approved cloud lifecycle operations. Not for Consumption-only workflow development.'
compatibility: 'Requires Azure CLI 2.67.0 or newer with the logicapp extension; its Python runtime must be 3.10 or newer. Local hosting and native tests have additional task-specific dependencies. Installation, connector catalogs, and Azure operations can require network access and Azure permissions.'

Logic Apps Standard CLI

Use `az logicapp` as the primary interface for supported Standard project, workflow, connection, validation, runtime, diagnostic, testing, and packaging operations. Do not manually recreate files or Azure wiring owned by a supported command. Manual workflow authoring, workspace files, ignore files, and infrastructure-as-code remain appropriate where the CLI does not own that operation.

Reviewed baseline: extension **1.0.0b1**. It is a public **preview** for evaluation and development, not a claim of production readiness. Use non-production resources for evaluation. Existing core app-management, app-settings, and ZIP-deployment commands are distinct from the extension's preview commands, even where reference pages label extension commands GA. Declared platform support is not live-runtime qualification.

Mandatory procedure routing

This folder is one installable skill package. Resolve bundled files relative to this `SKILL.md`, not the customer's working directory. Install/copy the entire folder. These references are required procedures, not optional background reading. See the [package README](README.md) for installation, provenance, and maintenance notes.

**Before the corresponding operation, read every applicable reference below.** For combined tasks, read each required procedure before its phase. If a required file is missing or unreadable, report that operation as blocked. Do not invent syntax, bypass its prerequisites, or fetch an unreviewed substitute.

| Requested operation | Required bundled procedure | |---|---| | Install/check dependencies; diagnose, start, or stop a host | [Local runtime](references/local-runtime.md) | | Discover connectors; create/change/test/delete connections; configure identity or ACLs | [Connections and identity](references/connections.md) | | Inspect/export/change live workflows; invoke/diagnose/cancel/replay runs | [Live workflows and runs](references/live-operations.md) | | Scaffold, plan, run, or inspect native workflow tests | [Workflow testing](references/testing.md) | | Package, deploy, or change deployment exclusions | [Packaging and deployment](references/packaging-deployment.md) |

Basic local scaffolding, workspace creation, and offline validation are specified here. Do not start a host, restore packages, invoke workflows, or mutate Azure merely because the skill was activated. Select only the procedures needed for the requested task.

Non-negotiable rules

1. **Inspect before mutation.** Establish the actual project root and requested scope. Inspect affected workflows, configuration structure/references, ignore files, workspaces, and uncommitted changes. Do not dump secret setting values. 2. **Preserve existing conventions.** Do not restructure repositories, convert workflow kinds, migrate authentication, normalize aliases, or replace user files unsolicited. 3. **Use managed identity by default.** For new connections and deployed app configuration, use another authentication method only when explicitly requested by the customer or unsupported by the selected connector/operation. Authentication failure is not proof of lack of support. Never silently fall back to secrets. 4. **Enable identity as part of new-project delivery.** Configure the supported local identity-based connection mechanism. For deployment-facing work, enable app identity through the authorized provisioning/deployment process. Preserve an existing identity convention; otherwise default to system-assigned identity. Local scaffolding does not authorize Azure mutation; report unapproved cloud prerequisites explicitly. 5. **Verify distinct principals and permissions.** A local process does not acquire a deployed app's managed identity. Follow the connector's documented local mechanism; do not assume every connector uses `DefaultAzureCredential`. Verify local and cloud principals, connection access, and least-privilege data-plane roles separately. 6. **Discover, do not guess.** Obtain connector IDs, operation IDs, parameter sets, and required input shapes from the actual runtime or regional managed catalog. Verify authentication support using metadata and authoritative connector documentation. 7. **Protect secrets and sensitive outputs.** Never put secret values in command arguments, source control, examples, or shared logs. Treat existing definitions, exports, and provider output as potentially sensitive; protect and review them before sharing. Use supported stdin secret input and setting references. Required protected local/runtime storage is permitted; local settings and test artifacts must be ignored and excluded from deployment. 8. **Keep environments configurable.** Put deployment-specific endpoints, resource IDs, and environment values in settings or parameters, not hardcoded workflow literals. 9. **Guard replacements and concurrency.** Inspect before every create; treat creation as non-idempotent. Use `--force` only for reviewed replacement. Export live workflows before replacement/deletion, retain revisions, and obtain approval for non-atomic writes. Do not bypass conflicts or blindly retry uncertain mutations. 10. **Authorize effects, not just targe