title: How to create Api connection to Azure KeyVault for Logic App with Managed Identity
body: <p><strong>Scenario</strong></p>
  <p>Hi, I would like to create <code>Logic App</code> that gets secret from <code>Azure KeyVault</code> and sends authenticated request to the API with secret from vault.</p>
  <p><strong>Problem</strong></p>
  <p>I receive: <code>The workflow connection parameter 'keyvault' is not valid. The API connection 'keyvault' is not configured to support managed identity.</code> during my ARM deploy. How to create <code>Microsoft.Web/Connections</code> with Managed identity from ARM template. There is no information about it in docs: <a href="https://docs.microsoft.com/en-us/azure/templates/microsoft.web/connections" rel="nofollow noreferrer">apiConnection</a> <a href="https://docs.microsoft.com/en-us/azure/logic-apps/create-managed-service-identity#authenticate-access-with-managed-identity" rel="nofollow noreferrer">logicapp-MSI</a></p>
  <p><strong>repro</strong></p>
  <pre><code>{
    &quot;type&quot;: &quot;Microsoft.Web/connections&quot;,
    &quot;apiVersion&quot;: &quot;2016-06-01&quot;,
    &quot;name&quot;: &quot;[variables('KeyVault_Connection_Name')]&quot;,
    &quot;location&quot;: &quot;[variables('location')]&quot;,
    &quot;kind&quot;: &quot;V1&quot;,
    &quot;properties&quot;: {
      &quot;api&quot;: {
        &quot;id&quot;: &quot;[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]&quot;
      },
      &quot;parameterValues&quot;: {
        &quot;vaultName&quot;: &quot;[variables('keyVaultName')]&quot;
      },
      &quot;displayName&quot;: &quot;[variables('KeyVault_Display_Connection_Name')]&quot;
    }
  },
  {
    &quot;type&quot;: &quot;Microsoft.Logic/workflows&quot;,
    &quot;apiVersion&quot;: &quot;2017-07-01&quot;,
    &quot;name&quot;: &quot;[variables('logicAppName')]&quot;,
    &quot;location&quot;: &quot;[variables('location')]&quot;,
    &quot;identity&quot;: {
      &quot;type&quot;: &quot;SystemAssigned&quot;
    },
    &quot;dependsOn&quot;: [
      &quot;[resourceId('Microsoft.Web/Connections', variables('KeyVault_Connection_Name'))]&quot;
    ],
    &quot;properties&quot;: {
      &quot;state&quot;: &quot;Enabled&quot;,
      &quot;definition&quot;: {
        &quot;$schema&quot;: &quot;https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#&quot;,
        &quot;contentVersion&quot;: &quot;1.0.0.0&quot;,
        &quot;parameters&quot;: {
          &quot;$connections&quot;: {
            &quot;defaultValue&quot;: {},
            &quot;type&quot;: &quot;Object&quot;
          }
        },
        &quot;triggers&quot;: {schedule trigger},
        &quot;actions&quot;: {get secret, send HTTP},
        &quot;outputs&quot;: {}
      },
      &quot;parameters&quot;: {
        &quot;$connections&quot;: {
          &quot;value&quot;: {
            &quot;keyvault&quot;: {
              &quot;connectionId&quot;: &quot;[concat('/subscriptions/', variables('subscriptionId'), '/resourceGroups/', variables('resourceGroupName'), '/providers/Microsoft.Web/connections/', variables('KeyVault_Connection_Name'))]&quot;,
              &quot;connectionName&quot;: &quot;[variables('KeyVault_Display_Connection_Name')]&quot;,
              &quot;connectionProperties&quot;: {
                &quot;authentication&quot;: {
                  &quot;type&quot;: &quot;ManagedServiceIdentity&quot;
                }
              },
              &quot;id&quot;: &quot;[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'),'/managedApis/keyvault')]&quot;
            }
          }
        }
      }
    }
  }
  </code></pre>
  <p><strong>Tried</strong></p>
  <p>I added <code>parameterValueType</code> with value Alternative to <code>Microsoft.Web/connections</code>. It was also necessary to remove parameterValue, because it cause an error.</p>
  <pre><code>{
      &quot;type&quot;: &quot;Microsoft.Web/connections&quot;,
      &quot;apiVersion&quot;: &quot;2016-06-01&quot;,
      &quot;name&quot;: &quot;[variables('KeyVault_Connection_Name')]&quot;,
      &quot;location&quot;: &quot;[variables('location')]&quot;,
      &quot;kind&quot;: &quot;V1&quot;,
      &quot;properties&quot;: {
          &quot;api&quot;: {
              &quot;id&quot;: &quot;[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]&quot;
          },
          &quot;parameterValueType&quot;: &quot;Alternative&quot;,
          &quot;displayName&quot;: &quot;[variables('KeyVault_Display_Connection_Name')]&quot;
      }
  },
  </code></pre>
  <p>now I receive error during runtime when GET secret:</p>
  <pre><code>{
    &quot;status&quot;: 400,
    &quot;message&quot;: &quot;The connection does not contain a vault name. Please edit the connection and enter a valid key vault name.&quot;,
    &quot;error&quot;: {
      &quot;message&quot;: &quot;The connection does not contain a vault name. Please edit the connection and enter a valid key vault name.&quot;
    },
    &quot;source&quot;: &quot;keyvault-we.azconn-we.p.azurewebsites.net&quot;
  }
  </code></pre>
  <p>I have also tried to add <code>vaultName</code> to <code>customParameterValues</code> but it did not help.</p>