Logic App Workflow Automation Not Triggering for Security Alerts

Question

I have set up a Logic App to trigger workflow automation for security alerts on Microsoft Defender. However, it is not triggering automatically, even after simulating security alerts on the storage account.

I can trigger the alerts manually, and I receive email notifications as expected based on the workflow setup in the Logic App.

Despite following the documentation, the workflow automation is not functioning as intended when connected to the Logic App.

Thank you

Regards

Mike

Answer 1

There could be several reasons why your Logic App workflow automation is not triggering for security alerts in Microsoft Defender. Here are some things to check:

1. Trigger Configuration: Ensure that the Logic App is configured with the correct trigger for security alerts. The triggers should be set to activate when a Defender for Cloud Alert is created or triggered. If you are using a deprecated trigger, it will not work.
2. Alert Severity Levels: If you have customized the trigger to only respond to specific severity levels, make sure that the simulated alerts fall within those levels.
3. Permissions: Verify that you have the necessary permissions to execute the Logic App and that the Logic App has access to the required resources.
4. Logic App Status: Check if the Logic App is enabled and not in a disabled state. Also, ensure that there are no issues with the Logic App itself that might prevent it from running.
5. Polling Interval: The Logic App trigger processes new alerts based on a specified polling interval. If no alerts are received during the polling period, the trigger will not run.

If you've checked all these aspects and the issue persists, you may want to consult the documentation for additional troubleshooting steps or consider reaching out to Microsoft support for further assistance.

---

References:

• Automate remediation responses
• Improve regulatory compliance
• Improve threat protection by integrating security operations with Microsoft Graph Security & Azure Logic Apps