Deploying Standard Azure Logic App to Virtual Network with secured storage account

---

Introduction

As Azure Logic Apps continues to be one of the go-to tools for integrations in Azure environments. Security is becoming an increasingly pressing matter when conducting integrations, making it a top priority. A great addition to this was introduced to public June 2021. The possibility to integrate Azure Logic Apps properly into a Virtual Network . Virtual Network integration is possible only with Standard Logic App.

The Problem

If you are testing this functionality, which is part of standard Logic Apps (not consumption). You will be using most likely Azure Portal to create and configure resources. Using Azure Portal to do this creates an issue.

Creation of storage file share failed with: ‘The remote server returned an error: (403) Forbidden.’. Please check if the storage account is accessible. (Target: /subscriptions/guid/resourceGroups/RG-name/providers/Microsoft.Web/sites/CRM-demopurpose-logic)

When first facing this issue, I remember doing the deployment multiple times and wondering what was going on. Do not waste time on that, instead keep on reading.

The Solution

The issue here is that the targeted storage account does not allow public access, and it just is not possible to deploy a standard Azure Logic App connected to it via the portal . The workaround is to deploy the resources in a specific order to succeed. Resources need to be deployed with an ARM template , a Bicep script, a Terraform script or such. I found help from this Azure Integration Services Blog: Deploying Standard Logic App to Storage Account behind Firewall using Service or Private Endpoints.

The ARM template, which I used to create the following resources in the correct order:

1. Storage account, which denies the public traffic
2. Virtual Network and Subnets
3. Private DNS Zones and Private Endpoints for blob, file, queue and table services (https://learn.microsoft.com/fi-fi/azure/storage/common/storage-private-endpoints)
4. File Share
5. App Service Plan (hosting)
6. Standard Logic App
7. Sets network config with the Virtual Network integration to connect storage account on private endpoints

I used this template as a basis to create my ARM template. As pictures always tell more here you are:

Step-by-step introduction on how to run the ARM template

Application Insights needs to be deployed beforehand as the template does not deploy it.

1. Type to Azure Portal’s search “deploy custom template” and click on found service “Deploy a custom template”

2. Select “Build your own template in the editor”. We can use this feature to upload the provided custom ARM template.

3. Click “Load file” and search for the downloaded custom ARM template (Standard-LogicApp-ARM-template.json).

4. Template loads to portal, and you should see 29 parameters and 22 resources on left side navigation. Select “Save”.

5. There are some predefined example values for some of the parameters. You should go through them all and set them according to your needs. Below is list of them and a short[AS1]  description.

Parameter	Example value	Description
Logic App FE Name		Name of the standard Logic App to be deployed.
File Share Name		File Share of the standard Logic App.
App Insight Name		Application Insights where the standard Logic App will be connected to.
Use32Bit Worker Process	true	Standard Logic Apps worker process bits.
Location	westeurope	Location to deploy resources to.
Hosting Plan FE Name		Standard Logic App’s App Service plan name.
Content Storage Account Name		Storage account to be created.
Sku	WorkflowStandard	App Service Plan’s tier.
Sku Code	WS1	App Service Plan’s pricing. https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-pricing#standard-pricing
Worker Size	3	App Service Plan’s worker size
Worker Size Id	3	App Service Plan’s worker size id
Number Of Workers	1	App Service Plan’s number of workers
Vnet Name	vnetName	Name of the VNET that the Function App and Storage account will communicate over.
Subnet Name		VNET subnet name.
Virtual Network Address Prefix	10.x.x.x/24	VNET address space.
Function Subnet Address Prefix	0.x.x.x/26	Function App’s subnet address range.
Private Endpoint Subnet Address Prefix	0.x.x.x/26	Storage account’s private endpoint’s subnet address range.
Private Storage File Dns Zone Name	privatelink.file	Private DNS Zone for Azure File storage
Private Storage Blob Dns Zone Name	privatelink.blob	Private DNS Zone for Azure Blob storage
Private Storage Queue Dns Zone Name	privatelink.queue	Private DNS Zone for Azure Queue storage
Private Storage Table Dns Zone Name	privatelink.table	Private DNS Zone for Azure Table storage
Private Endpoint File Storage Name	storageaccount-file-private-endpoint	Private endpoint for Azure File storage
Private Endpoint Blob Storage Name	storageaccount-blob-private-endpoint	Private endpoint for Azure Blob storage
Private Endpoint Queue Storage Name	storageaccount-queue-private-endpoint	Private endpoint for Azure Queue storage
Private Endpoint Table Storage Name	storageaccount-table-private-endpoint	Private endpoint for Azure Table storage
Virtual Network Links Suffix File Storage Name	privatelink.file-link	Virtual Network Link for Azure File storage
Virtual Network Links Suffix Blob Storage Name	privatelink.blob-link	Virtual Network Link for Azure Blob storage
Virtual Network Links Suffix Queue Storage Name	privatelink.queue-link	Virtual Network Link for Azure Queue storage
Virtual Network Links Suffix Table Storage Name	privatelink.table-link	Virtual Network Link for Azure Table storage

After giving all the parameters, select “Review + create”

6. Select “Create” and start the deployment process.

7. *Fireworks

Wrapping It Up

Congratulations! If you’ve followed our guide successfully, you should now have a secure standard Logic App up and running in Azure. Next, you can begin adding workflows and logic to your app. At Bofor, we frequently use standard Logic Apps to integrate Dynamics 365 or Power Platform with other systems. This might be your goal too! Keep an eye out for more tips on Azure, Dynamics 365, and Power Platform.

---