Azure Logic App Standard vnet integrated with a stateful workflow can't connect to a service bus behind a private endpoint

Question

When we want to configure the step 'Get message from a service bus topic (peek lock)', we have to choose the topic. When we click on the dropdown we get a 401 unauthorized' exception message.

We use managed identity of the logic app to authenticate to Azure service bus. With a stateless workflow it works.

Any ideas?

Thanks in advance!

Logic App and private endpoint reside in same vnet, default config (all subnets should be able to communicate to each other).

Tried SAS Key, Allowing service bus as service endpoint on the subnet where logic app resides in.

For the private endpoint we configured 'disable public access' (preferred option), also 'Allow traffic from specific networks' with the subnet of the logic app and IP of logic app.

Maybe a stateful workflow does not allow this setup?

Answer 1

I tried to reproduce the same in my environment and got the results like below:

I created logic app standard with vnet integrated like below:

Created service bus with private endpoint disabled public access,to Allow traffic from specific networks like below:

Created service bus topic along with subscription like below:

In logic app I created workflow with status type as stateful and trigger like below:

To check in service bus topic with subscription I got message in service bus like below:

Get https://khan321.azurewebsites.net/api/wk1/triggers/manual/invoke?api-version=2022-05-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=G-W7XXXXXXXXXX

Make sure in service bus Add Azure service bus Data Receiver role Assignment like beloe

To allow traffic in specfic vnet in your logic app -> Networking -> Access restriction -> allow virtual network subnet traffic to communciate each other

References:

Connect to Azure Service Bus from workflows - Azure Logic Apps | Microsoft Learn

Azure Logic Apps and Service Bus Peek Lock | Serverless360