Trigger workflows in Standard logic apps with Easy Auth

WadeMCG ,

If the signature is leaked, then one can regenerate the access key which will invalidate all signatures that came from it.

I understand your need to be able to disable SAS auth for added security. There is a way to disable SAS on the triggers so you may invoke the trigger using EasyAuth only. Set this property on the Logic App Standard properties (peer to SiteConfig)in the PUT Site call:

"logicAppsAccessControlConfiguration": {
    "triggers": {
        "sasAuthenticationPolicy": {
            "State": "Disabled"
        }
    }
}

Note that this will disable SAS authentication for triggers invoke requests and will also return the callback URLs for all triggers like request trigger, webhooks without SAS. This won't invalidate the existing SAS. So, when the SAS Authentication Policy State is Enabled, those existing SAS will continue to work.