Update Azure ARM templates with connector

Question

I use ARM template to deploy a Logic App that sends mail via a office365 connector. It works fine to deploy it, but if I update the template and want to redeploy it, the connector to office365 disconnect and I have to authorize the connection again. Is there any way to avoid disconnect the connector when I want to update the logicapp?

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "env_suffix": {
            "defaultValue": null,
            "type": "String"
        }
    },
    "variables": {
        "workflow_name": "[concat('GoMail', parameters('env_suffix'))]"
    },
    "resources": [
        {
          "type": "Microsoft.Web/connections",
          "apiVersion": "2016-06-01",
          "location": "[resourceGroup().location]",
          "name": "office365",
          "properties": {
            "api": {
              "id": "[concat(subscription().id,'/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/office365')]"
            },
            "displayName": "office365",
            "parameterValues": {
            }
          }
        },
        {
            "type": "Microsoft.Logic/workflows",
            "name": "[variables('workflow_name')]",
            "apiVersion": "2017-07-01",
            "location": "westeurope",
            "dependsOn": [
                "[resourceId('Microsoft.Web/connections', 'office365')]"
            ],
            "tags": {},
            "scale": null,
            "properties": {
                "state": "Enabled",
                "parameters": {
                    "$connections": {
                        "value": {
                            "office365": {
                                "connectionId": "[resourceId('Microsoft.Web/connections', 'office365')]",
                                "connectionName": "office365",
                                "id": "[concat(subscription().id,'/providers/Microsoft.Web/locations/westeurope/managedApis/office365')]"
                            }
                        }
                    }
                },
                "definition": {         
                    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
                    "actions": {
                        "Condition": {
                            "actions": {},
                            "else": {
                                "actions": {
                                    "Condition_2": {
                                        "actions": {
                                            "Send_an_email_2": {
                                                "inputs": {
                                                    "body": {
                                                        "Body": "@{base64ToString(triggerBody()?['payload'])}",
                                                        "From": "@triggerBody()?['from']",
                                                        "Importance": "Normal",
                                                        "IsHtml": true,
                                                        "Subject": "@triggerBody()?['subject']",
                                                        "To": "[email protected]"
                                                    },
                                                    "host": {
                                                        "connection": {
                                                            "name": "@parameters('$connections')['office365']['connectionId']"
                                                        }
                                                    },
                                                    "method": "post",
                                                    "path": "/Mail"
                                                },
                                                "runAfter": {},
                                                "type": "ApiConnection"
                                            }
                                        },
                                        "else": {
                                            "actions": {
                                                "Until": {
                                                    "actions": {
                                                        "Delay": {
                                                            "inputs": {
                                                                "interval": {
                                                                    "count": 10,
                                                                    "unit": "Second"
                                                                }
                                                            },
                                                            "runAfter": {
                                                                "Send_an_email_3": [
                                                                    "Failed"
                                                                ]
                                                            },
                                                            "type": "Wait"
                                                        },
                                                        "Send_an_email_3": {
                                                            "inputs": {
                                                                "body": {
                                                                    "Body": "@{base64ToString(triggerBody()?['payload'])}",
                                                                    "From": "[email protected]",
                                                                    "Importance": "Normal",
                                                                    "IsHtml": true,
                                                                    "Subject": "@triggerBody()?['subject']",
                                                                    "To": "@triggerBody()?['email']"
                                                                },
                                                                "host": {
                                                                    "connection": {
                                                                        "name": "@parameters('$connections')['office365']['connectionId']"
                                                                    }
                                                                },
                                                                "method": "post",
                                                                "path": "/Mail"
                                                            },
                                                            "runAfter": {},
                                                            "type": "ApiConnection"
                                                        }
                                                    },
                                                    "expression": "@equals(outputs('Send_an_email_3')['statusCode'], 200)",
                                                    "limit": {
                                                        "count": 5,
                                                        "timeout": "PT5M"
                                                    },
                                                    "runAfter": {},
                                                    "type": "Until"
                                                }
                                            }
                                        },
                                        "expression": "@endswith(triggerBody()?['email'], 'integtest.com')",
                                        "runAfter": {},
                                        "type": "If"
                                    }
                                }
                            },
                            "expression": "@equals(triggerBody()?['email'], 'ping')",
                            "runAfter": {},
                            "type": "If"
                        }
                    },
                    "contentVersion": "1.0.0.0",
                    "outputs": {},
                    "parameters": {
                        "$connections": {
                            "defaultValue": {},
                            "type": "Object"
                        }
                    },
                    "triggers": {
                        "manual": {
                            "inputs": {
                                "schema": {
                                    "properties": {
                                        "email": {
                                            "type": "string"
                                        },
                                        "payload": {
                                            "type": "string"
                                        },
                                        "subject": {
                                            "type": "string"
                                        }
                                    },
                                    "type": "object"
                                }
                            },
                            "kind": "Http",
                            "type": "Request"
                        }
                    }
                }
            }
        }
    ]
}

Answer 1

If you redeploy the logic app via template, the connection should be disconnected. I don't think you can authorize the connection along with the template. The connector is authorized by azure AD, the ARM template just includes the resources of your subscription but not the azure AD tier, azure ad is above the subscription.

Here is a similar issue answered by Microsoft, you could have a look.

Resolution:

Based on the observations, I had discussions with the experts, and it seems the connector currently can only take windows AD authentication and hence the issue. Product group has this feature update in the backlog and would be updating the connector in coming days, we do not have an ETA yet on this.

It says the feature will be updating in coming days, if the feature will support powershell, I think it will probably support ARM template, because the two ways should call the same rest api essentially.

Answer 2

You can separate the office365 Api connection template from logic apps template, you need just get the Api connection deployed and authorized for once, in your logic app, you just use the authorized Api connection.

In fact, it depends on the category of api connection you use, if not the kind of api connection(office365, outlook, keyvault custom connector,Dynamics CRM, salesforce) that needs MFA authorization，you can put your Api connection template together with your logic app template.