Azure Service Bus Sessions VNet Logic App

Question

Azure Service Bus Sessions VNet Logic App

Warren Kinley 81

All the documentation I have read regarding using Azure Service Bus sessions says that your logic app workflow just had to be stateless, however I receive the following error message when trying to complete the first message:

An error occurred in SBTriggerQueueSubscriber (xxxxxxxxxxxxxx058690313664CU00) whilst completing the first message: The service provider action failed with error code 'VNetPrivatePortsNotConfigured' and error message 'Using this service provider action in stateful workflows requires VNet integration and the site configuration vnetPrivatePortsCount to be set to a value greater than or equal to 2.'.

The workaround is that I placed the logic app in a vnet but why when the documentation says it is not a requirement?

Pashikanti Kumar 1,080 Reputation points Microsoft External Staff Moderator

2025-10-15T19:43:51.2+00:00
Hi Warren Kinley,

Thank you for posting your question in the Microsoft Q&A forum

The error VNetPrivatePortsNotConfigured indicates that the Azure Service Bus trigger in your Logic App is attempting to connect to a Service Bus namespace that is configured with Private Link or Virtual Network (VNet) Integration, but the required private endpoint configuration for the Logic App to communicate with the Service Bus is missing.

While the documentation states that a stateless Logic App can use Azure Service Bus sessions without requiring VNet integration, this assumes that the Service Bus namespace is publicly accessible (i.e., not restricted to a private network). If your Service Bus namespace is configured with Private Link or VNet Integration, additional steps are required to ensure connectivity.

Private Link or VNet Restriction

If your Service Bus namespace is configured to allow access only from a private network (via Private Link or VNet Integration), your Logic App must also be integrated into the same VNet to access the Service Bus.

Without VNet integration, the Logic App cannot resolve the private endpoint of the Service Bus namespace, resulting in the VNetPrivatePortsNotConfigured error.

Stateless Logic Apps and Public Access

Stateless Logic Apps can work with Service Bus sessions without requiring VNet integration only if the Service Bus namespace is publicly accessible.

If the Service Bus namespace is locked down to private endpoints, the Logic App must be integrated into the same VNet.

Steps to solve the Issue

Ensure proper VNet integration for your Logic App and Service Bus namespace

Verify Service Bus Namespace Configuration

Check whether your Service Bus namespace is configured with Private Link or VNet Integration:

In the Azure Portal, navigate to your Service Bus namespace.

Under Networking, check if Private Endpoint Connections or Virtual Network Rules are configured.

If private endpoints or VNet rules are enabled, your Logic App must also be integrated into the same VNet.

Configure Private Endpoint for Logic App

Ensure that the private endpoint for the Service Bus namespace is accessible from the subnet where your Logic App is integrated:

Verify that the subnet has the necessary Network Security Group (NSG) rules to allow traffic to the Service Bus private endpoint.

Ensure DNS resolution for the private endpoint is configured correctly.

Reference

Network security for Azure Service Bus - Azure Service Bus | Microsoft Learn

Azure Virtual Network Integration for Service Network Isolation | Microsoft Learn

Integrate your app with an Azure virtual network - Azure App Service | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Upvote" if the information helped you. This will help us and others in the community as well.

Thanks
Warren Kinley 81 Reputation points

2025-10-16T06:54:48.4766667+00:00

My service bus is not configured with a private link or on a vnet:
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Pravallika KV 165 Reputation points Microsoft External Staff Moderator

2025-10-17T11:58:27.0266667+00:00

Hi Warren Kinley,

Are you using service bus connector with peek lock trigger?
Warren Kinley 81 Reputation points

2025-10-17T14:30:53.8933333+00:00

The app plan that the logic app is not on a vnet.

The workflow is stateless.

The service is public.

I am polling for the next session peek-lock, then the stateless workflow fails when trying to complete the first message in the session.

Is the understanding that the Logic App app service plan needs to be in a vnet to allow the first message to be completed even though the service bus is public?
Pravallika KV 165 Reputation points Microsoft External Staff Moderator

2025-10-17T14:48:53.15+00:00
Warren Kinley, Correct.

The service provider action failed with error code 'VNetPrivatePortsNotConfigured' and error message 'Using this service provider action in stateful workflows requires VNet integration and the site configuration vnetPrivatePortsCount to be set to a value greater than or equal to 2

As mentioned in the above error, the peek/lock triggers with a subsequent call to Complete action require your Standard Logic Apps to be in stateful mode and you need to integrate your logic app with VNET.

Refer the following MSDOC for the steps.

Enable stateful mode for stateless built-in connectors in Azure Logic Apps.

https://techcommunity.microsoft.com/blog/integrationsonazureblog/enabling-service-bus-and-sap-built-in-connectors-for-stateful-logic-apps-in-stan/3820381

Please do "Upvote" if the information helped you. This will help us and others in the community as well.
Pravallika KV 165 Reputation points Microsoft External Staff Moderator

2025-10-20T04:33:41.1466667+00:00

Hi Warren Kinley,

Following up to see if the above provided answer was helpful. If it answers your query, please do upvote. If you have any further queries, do let us know.
Warren Kinley 81 Reputation points

2025-10-21T07:23:53.3933333+00:00

I will validate and respond on Wednesday when I am back working. Thanks
Pravallika KV 165 Reputation points Microsoft External Staff Moderator

2025-10-21T07:25:30.63+00:00

Sure Warren Kinley
Warren Kinley 81 Reputation points

2025-10-22T06:31:31.4533333+00:00
So, I have verified again my configuration, and I can confirm I still have an issue. What I know:

My Logic App Standard workflow is "stateless"

My Logic App App Service Plan is not on a VNet

The Service Bus is public - open to all networks

In my workflow the trigger is on a session enabled queue

The work trigger picks up the session successfully

The workflow fails trying to complete the first message in the session:

{ "statusCode": "BadRequest", "body": { "code": "ServiceProviderActionFailed", "message": "The service provider action failed with error code 'VNetPrivatePortsNotConfigured' and error message 'Using this service provider action in stateful workflows requires VNet integration and the site configuration vnetPrivatePortsCount to be set to a value greater than or equal to 2.'." } }

NOTE: When I place the App Service Plan on a VNet the workflow completes successfully.
Pravallika KV 165 Reputation points Microsoft External Staff Moderator

2025-10-22T14:55:52.8166667+00:00

Warren Kinley Based on my research, the peek/lock triggers with a subsequent call to Complete action require logic app to be integrated with VNET. We will check internally and revert back.

Your answer

Warren Kinley 81 Reputation points

2025-10-16T06:54:48.4766667+00:00

My service bus is not configured with a private link or on a vnet:
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Pravallika KV 165 Reputation points Microsoft External Staff Moderator

2025-10-17T11:58:27.0266667+00:00

Hi Warren Kinley,

Are you using service bus connector with peek lock trigger?
Warren Kinley 81 Reputation points

2025-10-17T14:30:53.8933333+00:00

The app plan that the logic app is not on a vnet.

The workflow is stateless.

The service is public.

I am polling for the next session peek-lock, then the stateless workflow fails when trying to complete the first message in the session.

Is the understanding that the Logic App app service plan needs to be in a vnet to allow the first message to be completed even though the service bus is public?
Pravallika KV 165 Reputation points Microsoft External Staff Moderator

2025-10-17T14:48:53.15+00:00

Warren Kinley, Correct.

The service provider action failed with error code 'VNetPrivatePortsNotConfigured' and error message 'Using this service provider action in stateful workflows requires VNet integration and the site configuration vnetPrivatePortsCount to be set to a value greater than or equal to 2

As mentioned in the above error, the peek/lock triggers with a subsequent call to Complete action require your Standard Logic Apps to be in stateful mode and you need to integrate your logic app with VNET.

Refer the following MSDOC for the steps.

Enable stateful mode for stateless built-in connectors in Azure Logic Apps.

https://techcommunity.microsoft.com/blog/integrationsonazureblog/enabling-service-bus-and-sap-built-in-connectors-for-stateful-logic-apps-in-stan/3820381

Please do "Upvote" if the information helped you. This will help us and others in the community as well.
Pravallika KV 165 Reputation points Microsoft External Staff Moderator

2025-10-20T04:33:41.1466667+00:00

Hi Warren Kinley,

Following up to see if the above provided answer was helpful. If it answers your query, please do upvote. If you have any further queries, do let us know.
Warren Kinley 81 Reputation points

2025-10-21T07:23:53.3933333+00:00

I will validate and respond on Wednesday when I am back working. Thanks
Pravallika KV 165 Reputation points Microsoft External Staff Moderator

2025-10-21T07:25:30.63+00:00

Sure Warren Kinley
Warren Kinley 81 Reputation points

2025-10-22T06:31:31.4533333+00:00

So, I have verified again my configuration, and I can confirm I still have an issue. What I know:

My Logic App Standard workflow is "stateless"

My Logic App App Service Plan is not on a VNet

The Service Bus is public - open to all networks

In my workflow the trigger is on a session enabled queue

The work trigger picks up the session successfully

The workflow fails trying to complete the first message in the session:

{ "statusCode": "BadRequest", "body": { "code": "ServiceProviderActionFailed", "message": "The service provider action failed with error code 'VNetPrivatePortsNotConfigured' and error message 'Using this service provider action in stateful workflows requires VNet integration and the site configuration vnetPrivatePortsCount to be set to a value greater than or equal to 2.'." } }

NOTE: When I place the App Service Plan on a VNet the workflow completes successfully.
Pravallika KV 165 Reputation points Microsoft External Staff Moderator

2025-10-22T14:55:52.8166667+00:00

Warren Kinley Based on my research, the peek/lock triggers with a subsequent call to Complete action require logic app to be integrated with VNET. We will check internally and revert back.

Share via

Azure Service Bus Sessions VNet Logic App

Your answer