Change in firewall config seems to have impacted real-time assessment of connector "When email arrives v3"

Vinicius Correia 0

Hi, this question touches on the behaviour mentioned in the question https://zcusa.951200.xyz/en-us/answers/questions/330052/logic-apps-outlook-new-email-v3-trigger-is-evaluat

Yesterday I executed the below commands to correct the non-compliancy on 2 specific policies related to firewall, and after that, my Logic App workflow stopped being triggered in real time when an email arrives and started taking in emails only in an hourly interval, which is way worse and impacts our business areas.

az functionapp update --name $lappName --resource-group $ResourceGroupName --set siteConfig.ipSecurityRestrictionsDefaultAction=Deny
az functionapp update --name $lappName --resource-group $ResourceGroupName --set siteConfig.scmIpSecurityRestrictionsDefaultAction=Deny

I wonder whether this is a bug and whether I will have to make the hard choice between being compliant with an important security requirement (it is enforced in my company) and having the Logic App behave as expected...

The behaviour can be seen below where the commands above were executed around 14:30 and after that, only the hourly triggers (as mentioned in the other question) works rather than really executing when an email arrives:

User's image

Silvia Wibowo 4,941 Reputation points Microsoft Employee

2025-01-08T03:29:10.3066667+00:00
Hi @Vinicius Correia , what's the structure of the trigger? For example:

New email v3 trigger -> Logic App -> Function App

If there are multiple apps (Logic App, Function App, App Service web app, or others), where do you put the access restriction (your 2 commands above)?

You can try adding Access Restriction opening (Allow) for service tag, either AzureConnectors, LogicApps, or AzureCloud, see which ones work:

az functionapp config access-restriction add -g ResourceGroup -n AppName --action Allow --priority 400 --rule-name servicetag1 --service-tag AzureConnectors az functionapp config access-restriction add -g ResourceGroup -n AppName --action Allow --priority 400 --rule-name servicetag1 --scm-site true --service-tag AzureConnectors
Vinicius Correia 0 Reputation points

2025-01-14T13:18:48.6366667+00:00

Hi Silvia, sorry for the delay and thanks for the suggestion, I´ll try it out and revert back, but to answer your question, it is only one logic app (standard) with only one workflow, and within the context of this one workflow, the behaviour changed once I added the default action of "Deny".

The quick summary of what it does is receive an email with a XML attachment, perform some basic checks, and if all is well, post it in an MQ, all contained in this one workflow.

Share via

Change in firewall config seems to have impacted real-time assessment of connector "When email arrives v3"

Your answer