unable to access storage account with a private endpoint from standard logic apps using managed identity

Question

unable to access storage account with a private endpoint from standard logic apps using managed identity

Vilas Rao Perka 30 Microsoft Employee

KapilAnanth 49,846 Reputation points Moderator

2024-06-13T07:15:27.9766667+00:00
@Vilas Rao Perka ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Can you please specify what exactly the issue is?

Because

"access storage account with a private endpoint" is a networking requirement

and "from standard logic apps using managed identity" is a identity requirement

Can you share the exact error message you are facing?

And share the network architecture of your set up.

For e.g., is your Logic App VNET Integrated?

Is the Private EndPoint of SA in the same VNET as the Logic App is integrated into?

For testing, you can first try

Accessing the Storage Account via Internet using Managed Identity

Accessing the Storage Account via Private EndPoint and setting the Access Level as Anonymous

This will tell us which step is the one causing the issue

Cheers,

Kapil

Answer accepted by question author

1 additional answer

Your answer

KapilAnanth 49,846 Reputation points Moderator

2024-06-13T07:15:27.9766667+00:00

@Vilas Rao Perka ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Can you please specify what exactly the issue is?

Because

"access storage account with a private endpoint" is a networking requirement

and "from standard logic apps using managed identity" is a identity requirement

Can you share the exact error message you are facing?

And share the network architecture of your set up.

For e.g., is your Logic App VNET Integrated?

Is the Private EndPoint of SA in the same VNET as the Logic App is integrated into?

For testing, you can first try

Accessing the Storage Account via Internet using Managed Identity

Accessing the Storage Account via Private EndPoint and setting the Access Level as Anonymous

This will tell us which step is the one causing the issue

Cheers,

Kapil

Answer 1

@Vilas Rao Perka ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

From your verbatim, I see

You have a Standard Logic Apps integrated into a VNET
You have created a PE of Storage Account in the same VNET
Using Managed Identity, you are able to connect to the Storage Account with Public Access
Your requirement is now to establish connectivity to the Storage Account via PE and Public Access disabled.
- Which actually gives a 403 error.

From my Analysis,

I don't think your requirement is supported.
Public Access working means there is no issue with Managed Identity.
However, I don't think the prebuilt connectors you use would be a part of the VNET
- And as such, it will not make connections using the Private IP Address range of the VNET you have integrated the Logic Apps with
See : AzureConnectors and Service Tags
So, instead, you should use
- "Enabled from selected virtual networks and IP addresses"
- And allow the IPs from AzureConnectors.<YOURLOGICAPPSREGION>
You confirmed that using the last step, you were able to establish connectivity.

P.S :

One thing to note here is that the Storage Account and Logic Apps should be in different regions for the above set up to work
This is because,
- See : Restrictions for IP network rules
Also from Logic Apps side
- See : Access Blob Storage in same region with system-managed identities

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

rn-0578 1 Reputation point

2024-10-01T18:34:55.6033333+00:00

hi , i am haveing the same issue with the logic apps. pls advise how do i resolve this
rn-0578 1 Reputation point

2024-10-01T18:40:03.44+00:00

my storage accounts and logic apps are in the same region
KapilAnanth 49,846 Reputation points Moderator

2024-10-03T05:07:55.1866667+00:00

rn-0578,

For same region, I don't think you can filter IPs.

You will be required to open the firewall to all

Cheers,

Kapil

Answer 2

We hit this scenario and found that the adding the AzureConnector IPs to the Storage account Firewall for our region allowed the required connectivity.

The Microsoft IP ranges can be downloaded here:
https://www.microsoft.com/en-us/download/details.aspx?id=56519

Background

We were limited on the region we had been allowed to use by a customer and so couldn't move the logic app or storage to another region.
We needed to keep the storage locked down as it contained files we did not want publicly accessible.

Our Storage account was set up with a private endpoint for Blob.
The Standard logic app was integrated within the same VNet (seperate subnets) as the private endpoint.
The Logic App was setup with a System managed Identity and Storage Blob Contributor permissions.

Before adding the AzureConnector IPs we could connect to the storage when the storage firewall was open, and could not connect when it was locked down.

Looking at the Audit logs we could see attempts were made by the System Managed Identity to Authenticate but these were failing and coming from a 10.x.x.x IP address which was not configured within our estate (This will be the backbone IP i imagine)

Once we added the AzureConnector ranges for our region, the connections worked.
(The Storage firewalls don't take /32 CIDRs, so for the /32 addresses just use the full IP, and for the /27 and /28 ranges put these in as CIDR format)

Hope this helps !

Share via

unable to access storage account with a private endpoint from standard logic apps using managed identity

1 additional answer

Your answer