I want to be able to route the traffic from my Azure Logic App (Standard) via my vnet to other resources on the vnet only. I've tried a lot of different things (current setup listed below), but the Logic App refuses to connect to my other resources over the vnet. According to Microsoft Support, Logic Apps will always have the outbound addresses found here. However, this really makes no sense to me. Why allow vnet integration, route tables, etc, when we can't actually control the outbound IP and can't send outbound traffic over the vnet? Has anyone been able to get their Logic App (Standard) to communicate with other resources via the vnet only?
My Logic App (Standard) setup:
- Access restrictions: deny all
- Private endpoint: on, in vnet subnet1
- App assigned address: N/A, "Feature is disabled due to private link being enabled"
- VNet integrations: on, in vnet subnet2
- Hybrid connections: off
- NAT gateway: off
- Network security group: off
- Route table: on, "0.0.0.0/0 -> next hop: VnetLocal"
I've tested the Logic App's inability to connect over vnet by having it talk to a form recognizer I set up. Form recognizers don't have "In App" connectors, so the routing routes should apply.
My Form Recognizer Setup
- Selected Networks and Private Endpoints: enabled
- Virtual networks: vnet subnet1, vnet subnet2, vnet subnet-gw
- Firewall: none
- Private endpoint: on, in vnet subnet1
Note: the above setup does work and the logic app can communicate with the form recognizer when I allowlist the connectors outbound IP addresses on the form recognizer firewall. The setup doesn't work when I remove these allowlisted IPs, which is the setup I'd like to be working.
Any help would be much appreciated!
