Blob storage / Logic App Workflow troubleshooting connecting through firewall

Hello Brandon Panasiuk •,

You're facing a connectivity issue between your Logic App and Blob Storage behind a firewall/VNet. The trigger "When a blob is added or modified (V2)" is failing due to network restrictions.

Enable "Trusted Microsoft Services" on Blob Storage

• Go to your Storage Account → Networking → Firewalls and virtual networks
• Under Exceptions, make sure “Allow trusted Microsoft services to access this storage account” is checked This includes Logic Apps etc.

Without this, your Logic App won't be able to see the blobs even if both are in the same region.

Use an ISE or Logic App Standard with VNet Integration

If you're using a Consumption-based Logic App, it cannot directly access private endpoints. You have two options:

Use Logic App Standard with VNet integration

• You must integrate the app with the same VNet/subnet where your storage resides
• Use a private DNS zone to resolve the storage account's private endpoint

OR

Use Azure Functions or an Azure VM inside the VNet to intermediate file access.

Check if the Blob trigger has permission to access the storage account

Ensure the managed identity (if used) or connection credentials have:

• Storage Blob Data Reader permission
• Assigned via Azure RBAC (not just access keys)

Go to:

• Storage Account → Access Control (IAM) → Assign role to your Logic App's identity.

Try accessing the blob container via a script or Postman using the same logic app connection method. See if access is blocked.

Temporarily disable the firewall or allow all networks, then test the trigger.

Use Diagnostics logs for the storage account (under Monitoring) to see if access is denied.

Please refer the below documentation:

Azure Storage firewall rules

Connect to Azure Blob Storage from workflows in Azure Logic Apps

Secure traffic between Standard logic apps and Azure virtual networks using private endpoints

Differences between Standard single-tenant logic apps versus Consumption multitenant logic apps

Trusted Azure services

Hope this helps!

Hi Krishna! Thank you for your response. I verified your suggestions were set up as specified (see below). Any other ideas?

Here are my responses:

• "Trusted Microsoft Services" on Blob Storage was previously enabled
• Logic App Standard with VNet integration is what is deployed and set up as you specified (see attached)
• T

would it be possible to connect live via chat to look through some things and validate setup? Would love to get a second set of eyes on it.

This is the result of the test with full public access:

{
    "type": "MsPortalFx.Errors.AjaxError",
    "baseTypes": [
        "MsPortalFx.Errors.AjaxError",
        "MsPortalFx.Errors.Error"
    ],
    "data": {
        "uri": "https://logicapp-sftp-to-sp.azurewebsites.net:443/runtime/webhooks/workflow/scaleUnits/prod-00/workflows/e146ac77beb545d78f147998aadbbdb8/triggers/When_a_blob_is_added_or_modified_(properties_only)_(V2)/histories/08584470176700742371356789820CU00/contents/TriggerInputs?api-version=2018-11-01&code=_REDACTED_CODE_&se=2025-08-07T21%3A00%3A00.0000000Z&sp=%2Ftriggers%2FWhen_a_blob_is_added_or_modified_%28properties_only%29_%28V2%29%2Fhistories%2F08584470176700742371356789820CU00%2Fcontents%2FTriggerInputs%2Fread&sv=1.0&sig=_REDACTED_SAS_TOKEN_SIG_",
        "type": "GET",
        "pathAndQuery": "",
        "requestId": "a30cdf41-1739-4774-9e54-20948c86d02c",
        "failureCause": "",
        "sessionId": "1f0fa95e3acc47b7aadf26820f5ebd04",
        "status": 0,
        "statusText": "error",
        "duration": 743.7000000476837
    },
    "extension": "Microsoft_Azure_EMA",
    "errorLevel": 0,
    "timestamp": 7441472.900000095,
    "name": "AjaxError",
    "innerErrors": [],
    "textStatus": "error",
    "errorThrown": "",
    "jqXHR": {
        "readyState": 0,
        "status": 0,
        "statusText": "error"
    }

{
    "type": "MsPortalFx.Errors.AjaxError",
    "baseTypes": [
        "MsPortalFx.Errors.AjaxError",
        "MsPortalFx.Errors.Error"
    ],
    "data": {
        "uri": "https://logicapp-sftp-to-sp.azurewebsites.net:443/runtime/webhooks/workflow/scaleUnits/prod-00/workflows/e146ac77beb545d78f147998aadbbdb8/triggers/When_a_blob_is_added_or_modified_(properties_only)_(V2)/histories/08584470176700742371356789820CU00/contents/TriggerOutputs?api-version=2018-11-01&code=_REDACTED_CODE_&se=2025-08-07T21%3A00%3A00.0000000Z&sp=%2Ftriggers%2FWhen_a_blob_is_added_or_modified_%28properties_only%29_%28V2%29%2Fhistories%2F08584470176700742371356789820CU00%2Fcontents%2FTriggerOutputs%2Fread&sv=1.0&sig=_REDACTED_SAS_TOKEN_SIG_",
        "type": "GET",
        "pathAndQuery": "",
        "requestId": "a30cdf41-1739-4774-9e54-20948c86d02e",
        "failureCause": "",
        "sessionId": "1f0fa95e3acc47b7aadf26820f5ebd04",
        "status": 0,
        "statusText": "error",
        "duration": 417.69999980926514
    },
    "extension": "Microsoft_Azure_EMA",
    "errorLevel": 0,
    "timestamp": 7495963.800000191,
    "name": "AjaxError",
    "innerErrors": [],
    "textStatus": "error",
    "errorThrown": "",
    "jqXHR": {
        "readyState": 0,
        "status": 0,
        "statusText": "error"
    }