Azure Logic App Shared Access Signature
Detects Azure Logic App shared access signature (SAS) URL patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Engine
- universal
- Confidence
- high
- Confidence justification
- High confidence: logic.azure.com domain combined with sig parameter provides strong structural constraint unique to Logic Apps. Added context gating and exclusion rules improve precision and reduce incidental matches.
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
- Data categories
- credentials, security
- Scope
- specific
- Risk rating
- 10
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported
Pattern
(?i)https?://[^/]*logic\.azure\.com[^"'\s]*[?&]sig=[A-Za-z0-9%+/=_-]+Corroborative evidence keywords
Logic App, logic app, workflow, trigger, logic.azure.com, SAS, sig, shared access signature, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie (+45 more)
Proximity: 300 characters
Should match
https://prod-00.westus.logic.azure.com/workflows/aaaa0000/triggers/manual/paths/invoke?api-version=2016-10-01&sig=AAAA0000BBBB— Logic App trigger URL with SAShttps://test-01.eastus.logic.azure.com/workflows/test/triggers/request?sig=0000000000000000— Logic App URL with test sighttps://prod-42.northeurope.logic.azure.com:443/workflows/run?sig=ABCDEFghijklmnop%2B— Logic App URL with encoded sig parameter
Should not match
https://prod-00.westus.logic.azure.com/workflows/aaaa0000/triggers/manual— Logic App URL without sig parameterhttps://myapp.azurewebsites.net?sig=test— Non-Logic App URL with sig parametertemplate example placeholder record identifier— Template/sample context should be excluded even when anchor words are present
Known false positives
- Logic App documentation with example trigger URLs. Mitigation: Check for common placeholder values in the sig parameter.
- Expired Logic App SAS URLs that no longer provide access. Mitigation: Flag for review regardless since the URL structure reveals workflow endpoints.