Securing Shared API Connections in Azure Logic Apps Standard with Access Policies

The Problem

In an enterprise integration platform built on Azure Logic Apps Standard, you will almost always end up with multiple Logic Apps in the same resource group — each handling a different integration domain. It is also common to share infrastructure: a single Office 365 managed connection, a single on-premises data gateway connection, or a set of SFTP connections that several Logic Apps legitimately need.

This creates two design tensions:

Security: You do not want Logic App A to be able to use a managed connection intended only for Logic App B.

Operability: You do not want to provision a separate copy of every connection for every Logic App — that duplicates infrastructure and doubles your maintenance burden.