Logic App Standard built-in SQL connector fails when connection string app setting uses Key Vault reference (@Microsoft.KeyVault(SecretUri=...))

Cobarrubias, Ian Luis 0 Reputation points
2026-09-01T14:03:17.78+00:00

Environment

  • Azure Logic Apps Standard, single-tenant, stateful workflow
  • Built-in SQL Server connector (serviceProviderId: /serviceProviders/sql), operation executeQuery
  • Authentication type: Connection String
  • Target: Azure SQL Database with public network access disabled (private endpoint only)
  • Managed identity authentication is not permitted for this SQL server per network/security policy, so I need SQL username/password auth

What I'm trying to do

I want to avoid storing the literal SQL connection string in the Logic App's connection configuration. Instead, I created:

  1. A Key Vault secret containing the full SQL connection string: 
    
   Server=tcp:<server>.database.windows.net,1433;Initial Catalog=<db>;User ID=<user>;Password=<password>;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;
  2. An app setting on the Logic App: 
       
   MSSQL_CONNECTION_STRING = @Microsoft.KeyVault(SecretUri=https://<vault>.vault.azure.net/secrets/<secret-name>)

What I tried

In the SQL connector's connection creation dialog (Connection String auth type), I entered:


@appsetting('MSSQL_CONNECTION_STRING')

Error received


{

  "code": "ServiceProviderActionFailed",

  "message": "The service provider action failed with error code 'BadRequest' and error message 'Connection creation failed with the following error: \"Keyword not supported: '@microsoft.keyvault(secreturi'.\". Please ensure you are using a valid connection string.'."

}

This indicates the connector received the literal unresolved @Microsoft.KeyVault(...) string rather than the value App Service normally resolves for standard app settings, and tried to parse it as SQL connection-string syntax.

Question

  1. Is it expected behavior that the built-in SQL connector's connection-creation step does not resolve @Microsoft.KeyVault(SecretUri=...) app-setting references at connection-create time?
  2. Is there a supported way to have the built-in SQL Server connector's Connection String field consume a Key Vault-backed secret at runtime, without pasting the literal connection string into the connection configuration through the Designer?

Any pointers to the specific supported pattern (or confirmation that literal-secret-in-connection is currently the only option for this connector) would be appreciated.

Azure Logic Apps
Azure Logic Apps

An Azure service that automates the access and use of data across clouds without writing code.

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-01T14:03:43.1833333+00:00

    Yes. That behavior is consistent with how unresolved Key Vault references behave: when a reference is not resolved properly, the platform passes the literal @Microsoft.KeyVault(...) string through, and consumers then treat it as the setting value. In this case, the SQL built-in connector is parsing that literal text as a SQL connection string, which produces Keyword not supported: '@microsoft.keyvault(secreturi'.

    The supported facts in the documentation are:

    1. Key Vault references can be used as app settings or connection strings for App Service, Azure Functions, and Logic Apps (Standard).
    2. If a Key Vault reference is not resolved properly, the literal reference string is used instead.
    3. For Azure Functions SQL bindings, a connection setting can point to a Key Vault reference, but the provided material does not state the same support model for the Logic Apps Standard built-in SQL Server connector connection-creation experience.

    Based on the available documentation, there is no documented supported pattern here showing that the Logic Apps Standard built-in SQL Server connector’s Connection String field resolves an @appsetting(...) value that itself contains a Key Vault reference during connection creation in the designer.

    For the specific questions:

    1. Is this expected?
      The observed failure is consistent with the documented behavior for unresolved Key Vault references: the literal @Microsoft.KeyVault(...) value is used. That matches the error returned by the connector.
    2. Is there a supported way, from the provided documentation, to make this built-in SQL connector consume a Key Vault-backed connection string through that designer field?
      No supported pattern is documented in the provided material for this connector scenario.

    What can be verified from the available guidance:

    • Logic Apps Standard supports Key Vault references in app settings generally.
    • If the reference resolves, app code can use it like a normal app setting.
    • If it does not resolve, the raw reference string is passed through.
    • The built-in SQL connector error shows it is receiving the raw reference string at connection creation time.

    To validate whether the app setting itself is resolving correctly in the Logic App resource, check the Key Vault reference status in Azure portal:

    1. Go to the Logic App Standard app resource.
    2. Open Application Settings.
    3. Select Edit for MSSQL_CONNECTION_STRING.
    4. Review the status/error details for that Key Vault reference.

    If the status is missing, the syntax is invalid. If the syntax is valid, the portal shows resolution status and errors. The built-in diagnostics can also help:

    1. Go to the app.
    2. Select Diagnose and solve problems.
    3. Use the Key Vault application settings diagnostics detector.

    If the app setting resolves successfully there, the remaining gap is still that the provided documentation does not describe a supported designer-time pattern for the built-in SQL connector to consume that Key Vault-backed app setting indirectly.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Jose Benjamin Solis Nolasco 12,201 Reputation points Volunteer Moderator
    2026-09-01T16:08:03.0766667+00:00

    @Cobarrubias, Ian Luis I hope you are doing well,

    The behavior you're seeing is consistent with a limitation in how the SQL Server built-in connector creates its connection.The Key Vault reference itself is a supported pattern for Logic Apps Standard app settings, and Microsoft recommends using Key Vault to protect connection strings when managed identity isn't available.

    However, the SQL built-in connector's Connection String parameter is documented as requiring the actual SQL connection string. There is currently no documented pattern showing that the Designer resolves:

    @appsetting('MSSQL_CONNECTION_STRING')

    when that app setting itself contains:

    @Microsoft.KeyVault(SecretUri=...)

    Your error strongly indicates that the connector is receiving the unresolved Key Vault expression and attempting to parse it as a SQL connection string.

    I would therefore verify the Key Vault reference resolves correctly in the Logic App's Configuration > Application settings first. If it does, the remaining issue is the connector's connection-creation path rather than Key Vault access.

    For the supported pattern, see Microsoft's guidance on using Key Vault with Logic Apps Standard:

    Use Key Vault references as app settings

    SQL Server built-in connector

    At this point, I would not claim that the built-in SQL connector supports a nested Key Vault reference in its Designer connection-string field unless Microsoft documents that scenario explicitly.

    If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.

     

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.