azure-logic-apps-standard-cli skill

Logic Apps Standard CLI

Use az logicapp as the primary interface for supported Standard project, workflow, connection, validation, runtime, diagnostic, testing, and packaging operations. Do not manually recreate files or Azure wiring owned by a supported command. Manual workflow authoring, workspace files, ignore files, and infrastructure-as-code remain appropriate where the CLI does not own that operation.

Reviewed baseline: extension 1.0.0b1. It is a public preview for evaluation and development, not a claim of production readiness. Use non-production resources for evaluation. Existing core app-management, app-settings, and ZIP-deployment commands are distinct from the extension's preview commands, even where reference pages label extension commands GA. Declared platform support is not live-runtime qualification.

Mandatory procedure routing

This folder is one installable skill package. Resolve bundled files relative to this SKILL.md, not the customer's working directory. Install/copy the entire folder. These references are required procedures, not optional background reading. See the package README for installation, provenance, and maintenance notes.

Before the corresponding operation, read every applicable reference below. For combined tasks, read each required procedure before its phase. If a required file is missing or unreadable, report that operation as blocked. Do not invent syntax, bypass its prerequisites, or fetch an unreviewed substitute.

Basic local scaffolding, workspace creation, and offline validation are specified here. Do not start a host, restore packages, invoke workflows, or mutate Azure merely because the skill was activated. Select only the procedures needed for the requested task.

Non-negotiable rules

Inspect affected workflows, configuration structure/references, ignore files, workspaces, and uncommitted changes. Do not dump secret setting values.

1. Inspect before mutation. Establish the actual project root and requested scope.

kinds, migrate authentication, normalize aliases, or replace user files unsolicited.

1. Preserve existing conventions. Do not restructure repositories, convert workflow

use another authentication method only when explicitly requested by the customer or unsupported by the selected connector/operation. Authentication failure is not proof of lack of support. Never silently fall back to secrets.

1. Use managed identity by default. For new connections and deployed app configuration,

identity-based connection mechanism. For deployment-facing work, enable app identity through the authorized provisioning/deployment process. Preserve an existing identity convention; otherwise default to system-assigned identity. Local scaffolding does not authorize Azure mutation; report unapproved cloud prerequisites explicitly.

1. Enable identity as part of new-project delivery. Configure the supported local

deployed app's managed identity. Follow the connector's documented local mechanism; do not assume every connector uses DefaultAzureCredential. Verify local and cloud principals, connection access, and least-privilege data-plane roles separately.

1. Verify distinct principals and permissions. A local process does not acquire a

required input shapes from the actual runtime or regional managed catalog. Verify authentication support using metadata and authoritative connector documentation.

1. Discover, do not guess. Obtain connector IDs, operation IDs, parameter sets, and

source control, examples, or shared logs. Treat existing definitions, exports, and provider output as potentially sensitive; protect and review them before sharing. Use supported stdin secret input and setting references. Required protected local/runtime storage is permitted; local settings and test artifacts must be ignored and excluded from deployment.

1. Protect secrets and sensitive outputs. Never put secret values in command arguments,

and environment values in settings or parameters, not hardcoded workflow literals.

1. Keep environments configurable. Put deployment-specific endpoints, resource IDs,

as non-idempotent. Use --force only for reviewed replacement. Export live workflows before replacement/deletion, retain revisions, and obtain approval for non-atomic writes. Do not bypass conflicts or blindly retry uncertain mutations.

1. Guard replacements and concurrency. Inspect before every create; treat creation

code can contact real systems. Establish permitted effects first. Obtain explicit authorization for Azure mutations, cancellation, and replay; preview is not a sandbox.

1. Authorize effects, not just targets. Starting local triggers and running test/build

configured, authorized, accepted, observed, and verified states. An open port, accepted invocation, generated plan, or inspected report is not successful workflow execution.

1. Keep evidence honest. Read structured results even on nonzero exits. Distinguish

full-project validation before release packaging/deployment. Preserve stricter repository policy. Do not remove warnings, assertions, outputs, or guards merely to obtain a passing result.

1. Validate without manufacturing success. Validate incrementally; require strict

running; verify shutdown and shared dependency ownership. Never kill processes by name or stop another user's host/emulator.

1. Own cleanup precisely. Stop only task-owned runtimes unless asked to leave them

entries; inspect the actual package. Do not deploy local settings, tests, state, editor files, logs, settings templates, or generated packages.

1. Preserve deployment boundaries. Merge ignore rules without replacing unrelated

for delivery guarantees, poison handling, and operation-specific tests. If unavailable, use authoritative connector documentation; do not invent specialized behavior.

1. Keep connector semantics specialized. Use available connector-specific guidance

Defaults and consequential choices

Infer paths and established choices from the request/repository. Ask only about missing, consequential decisions. Do not insist on three scaffold questions when answers are known.

1. Verify tooling and select the target

Inspect first; these commands do not install the extension:

az version
az extension list --query "[?name=='logicapp'].{name:name,version:version}" --output table

Minimums for the reviewed release: Azure CLI 2.67.0 and its Python runtime 3.10. If the extension is absent and installation is authorized, use the public extension index:

az extension add --name logicapp --version 1.0.0b1 --allow-preview true
az extension show --name logicapp --output json
az logicapp --help

Check the exit after each command; do not continue after failed installation. If the requested version is unavailable, report the index/network/version error. Do not substitute a private wheel, disable TLS, or bypass organizational package policy. Do not automatically upgrade an installed extension. For a different installed version, inspect each affected command's --help and current official contracts before execution; report material differences instead of assuming this baseline still applies.

Detect OS and shell before using examples. Single-line azurecli blocks avoid shell-specific continuations. App, Orders, and uppercase identifiers are illustrative names: substitute the inspected target, quote paths containing spaces, and use the host OS's path separator. PowerShell/native-wrapper quoting for expressions is specified in the connections procedure.

For API-targeting commands, explicit --port requires --local. A named context owns its coordinates: do not mix it with explicit API target flags. Inspect command-specific help for file-command context combinations; do not assume one universal precedence rule. Cloud work requires the intended Azure login, tenant, subscription, and permissions. Verify account selection independently: saved contexts do not bind subscription/tenant. Avoid changing global account selection; prefer explicit --subscription in automation.

2. Inspect and scaffold locally

Classify the destination as new, an existing Standard project, or a nonempty unrecognized directory. The project/host root contains host.json; workflow directories are its direct children. The repository root may itself be that project root.

For an existing project, inspect host.json, workflow files, connections.json, parameters.json when present, settings names/references, ignore files, workspaces, and affected uncommitted changes. Preserve unrelated content and avoid exposing local values.

For a new project, choose a minimal project-at-root layout or a solution/monorepo child project according to requirements. Support directories such as docs, requests, fixtures, tests, logs, and artifacts are optional and created only for actual work. Prefer package output outside the host root. Do not author .azurelogicapps runtime state.

After inspecting the destination, scaffold using explicit paths:

az logicapp project create --path App --workflow Orders

Add --workflow-kind Stateless only for an intentional Stateless choice. Use --adopt only for a reviewed nonempty unrecognized directory, not as routine setup. Inspect generated host/settings/connection/workflow files before extending them. Create additional workflows without replacing existing ones:

az logicapp workflow create --path App --workflow Notify --kind Stateful

--file FILE accepts a reviewed full workflow file or bare definition for local import. Creation is local-only and non-idempotent. Do not use it to add a cloud workflow.

Before writing sensitive local settings, confirm effective Git exclusions. Merge rules relative to the actual repository and host roots; never copy .gitignore over .funcignore. Always exclude local settings/state from source control and deployment. If changing deployment exclusions, first read the packaging procedure and follow its concrete rules.

Gate: Correct project root, requested workflow kinds, preserved user files, effective secret exclusions, and identity-based configuration or an explicitly reported prerequisite.

3. Optional workspace and context