VNet Integration in Azure Standard Logic App Slots Error

Question

VNet Integration in Azure Standard Logic App Slots Error

Philip Fuerste 0

I am trying to integrate a slot of my Standard Logic App into a virtual network, but the logic App seems to have trouble connecting to the file share of a storage account. This is my setup:

Storage Account with access only over private endpoints and a file share
6 private endpoints (web, queue, table, blob, file, dfs)
Standard Logic App with no virtual network integration
Logic App SLOT for App above with outbound traffic through a subnet in the same vnet as the Storage Accounts private endpoints
Rbac Roles for the identity used by the logic app (&slot) to access the storage account
Environment Variables like "WEBSITE_VNET_ROUTE_ALL" = 1, "WEBSITE_CONTENTOVERVNET" = 1, "WEBSITE_CONTENTSHARE"

With this setup both the App itself and the slot only show "Error" under runtime version. Zip deployments also timeout when trying to reach the scm-site. The connection issue for the non-slot is expected, as it is not vnet integrated, but why is the slot not able to connect to the file share? When I integrate both into the vnet, both stop throwing the error, so it seems the slot is routing some traffic over the non-slot? The Setup with only a second slot routing outbound traffic over the vnet is import to me due to some company policies and it is giving me no troubles with function, container and webapps, only with this Standard Logic App. Is this a bug?

Khadeer Ali 4,960 Reputation points Microsoft External Staff

2025-04-15T16:03:03.6233333+00:00

@Philip Fuerste
If integrating both the app and the slot into the virtual network resolves the issue, it suggests that the slot may not be routing all traffic correctly when only the slot is integrated. This behavior may not necessarily be a bug, but rather a limitation in how Standard Logic App slots handle VNet routing and file share access when the main app is not also VNet-integrated. The slot may still rely on certain shared infrastructure (such as file share mounting) configured through the main app, which can result in connectivity issues when the parent app is not part of the VNet. I will check with the internal team as well to confirm if this is an expected limitation.
Praveen Kumar Gudipudi 170 Reputation points Microsoft External Staff

2025-04-17T18:50:32.5066667+00:00
Sonny Gillissen 3,596 Reputation points

2025-04-19T19:12:45.6+00:00

Hi Philip Fuerste

Thanks for reaching out on Microsoft Q&A!

You’re stating that you’ve got a Storage Account connected to a VNet using Private Endpoints, but your Logic App Standard is not. This cannot work as your Logic App Standard needs a connection to the Storage Account for it to work, so you need to integratie the Logic App Standard with the VNet. Without the service won’t come up.

Logic App Standard basically works like the good-old IIS service, which also doesn’t come up when the folder defined for your webservice is inaccesible.

Please click ‘Accept answer’ if you think my answer is helpful. Feel free to drop additional queries in the comments below!

Kind regards,

Sonny
Khadeer Ali 4,960 Reputation points Microsoft External Staff

2025-04-21T12:49:05.0966667+00:00

Philip Fuerste,

Just checking in to see if the answer provided by Sonny Gillissen helped resolve your query. If it answers your question, please consider clicking Accept Answer and selecting Yes for "Was this answer helpful?" This helps others in the community as well!
Philip Fuerste 0 Reputation points

2025-04-22T09:34:52.7266667+00:00

Hi Sonny,
thanks for your answer.

I am aware that the service which is trying to reach a private endpoint has to be integrated into the VNet. This is the case for my Logic App Slot.
I am not quite sure I understand your answer fully (as you did not mention slots): Are you saying that the Logic App itself needs to be integrated into the VNet too to allow the second, VNet-integrated slot to access the storage via private endpoint?
Khadeer Ali 4,960 Reputation points Microsoft External Staff

2025-04-22T12:35:03.1233333+00:00

@Philip Fuerste ,To help clarify and potentially resolve the issue, I recommend reviewing the following blog post on the Microsoft Community Hub:

Deploying Standard Logic App to Storage Account behind Firewall using Service or Private Endpoints

This article walks through the setup and considerations when deploying Standard Logic Apps to storage accounts that are secured with private endpoints or firewall rules. It also touches on networking configurations, which may be relevant to the slot behavior you're seeing.

Could you please review it and see if the approach aligns with your current setup? It might provide insight into whether additional configuration is required.
Philip Fuerste 0 Reputation points

2025-04-23T06:56:45.2833333+00:00

Thanks Khadeer, I did already know of this article and tried every step in it before raising this issue.
Madugula Jahnavi 410 Reputation points Microsoft External Staff

2025-04-30T15:52:40.0933333+00:00

Hi Philip Fuerste, Can you check the logic app network settings by visiting Outbound traffic configuration and make sure that both the main app service and the slot are configured to route traffic through the specific VNet.
RithwikBojja 2,080 Reputation points Microsoft External Staff

2025-05-02T05:28:37.03+00:00

Hi @Philip Fuerste Try to change the below setting to 2 and check:

Your answer

Khadeer Ali 4,960 Reputation points Microsoft External Staff

2025-04-15T16:03:03.6233333+00:00

@Philip Fuerste
If integrating both the app and the slot into the virtual network resolves the issue, it suggests that the slot may not be routing all traffic correctly when only the slot is integrated. This behavior may not necessarily be a bug, but rather a limitation in how Standard Logic App slots handle VNet routing and file share access when the main app is not also VNet-integrated. The slot may still rely on certain shared infrastructure (such as file share mounting) configured through the main app, which can result in connectivity issues when the parent app is not part of the VNet. I will check with the internal team as well to confirm if this is an expected limitation.
Praveen Kumar Gudipudi 170 Reputation points Microsoft External Staff

2025-04-17T18:50:32.5066667+00:00
Sonny Gillissen 3,596 Reputation points

2025-04-19T19:12:45.6+00:00

Hi Philip Fuerste

Thanks for reaching out on Microsoft Q&A!

You’re stating that you’ve got a Storage Account connected to a VNet using Private Endpoints, but your Logic App Standard is not. This cannot work as your Logic App Standard needs a connection to the Storage Account for it to work, so you need to integratie the Logic App Standard with the VNet. Without the service won’t come up.

Logic App Standard basically works like the good-old IIS service, which also doesn’t come up when the folder defined for your webservice is inaccesible.

Please click ‘Accept answer’ if you think my answer is helpful. Feel free to drop additional queries in the comments below!

Kind regards,

Sonny
Khadeer Ali 4,960 Reputation points Microsoft External Staff

2025-04-21T12:49:05.0966667+00:00

Philip Fuerste,

Just checking in to see if the answer provided by Sonny Gillissen helped resolve your query. If it answers your question, please consider clicking Accept Answer and selecting Yes for "Was this answer helpful?" This helps others in the community as well!
Philip Fuerste 0 Reputation points

2025-04-22T09:34:52.7266667+00:00

Hi Sonny,
thanks for your answer.

I am aware that the service which is trying to reach a private endpoint has to be integrated into the VNet. This is the case for my Logic App Slot.
I am not quite sure I understand your answer fully (as you did not mention slots): Are you saying that the Logic App itself needs to be integrated into the VNet too to allow the second, VNet-integrated slot to access the storage via private endpoint?
Khadeer Ali 4,960 Reputation points Microsoft External Staff

2025-04-22T12:35:03.1233333+00:00

@Philip Fuerste ,To help clarify and potentially resolve the issue, I recommend reviewing the following blog post on the Microsoft Community Hub:

Deploying Standard Logic App to Storage Account behind Firewall using Service or Private Endpoints

This article walks through the setup and considerations when deploying Standard Logic Apps to storage accounts that are secured with private endpoints or firewall rules. It also touches on networking configurations, which may be relevant to the slot behavior you're seeing.

Could you please review it and see if the approach aligns with your current setup? It might provide insight into whether additional configuration is required.
Philip Fuerste 0 Reputation points

2025-04-23T06:56:45.2833333+00:00

Thanks Khadeer, I did already know of this article and tried every step in it before raising this issue.
Madugula Jahnavi 410 Reputation points Microsoft External Staff

2025-04-30T15:52:40.0933333+00:00

Hi Philip Fuerste, Can you check the logic app network settings by visiting Outbound traffic configuration and make sure that both the main app service and the slot are configured to route traffic through the specific VNet.
RithwikBojja 2,080 Reputation points Microsoft External Staff

2025-05-02T05:28:37.03+00:00

Hi @Philip Fuerste Try to change the below setting to 2 and check:

Share via

VNet Integration in Azure Standard Logic App Slots Error

Your answer