Logic App Workflow Automation Not Triggering for Security Alerts

Mike Ter 0

I have set up a Logic App to trigger workflow automation for security alerts on Microsoft Defender. However, it is not triggering automatically, even after simulating security alerts on the storage account.

I can trigger the alerts manually, and I receive email notifications as expected based on the workflow setup in the Logic App.

Despite following the documentation, the workflow automation is not functioning as intended when connected to the Logic App.

Thank you

Regards

Mike

Shireesha Eeraboina (Quadrant Resource LLC) 660 Reputation points Microsoft Vendor

2025-01-07T07:42:05.7766667+00:00
Hi @ Mike Ter,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Based on the information provided, it seems you are attempting to configure security alerts for a storage account by enabling Defender for Cloud, but the Logic App is not being triggered for the generated security alert.

Could you confirm if there is any specific documentation you are following?

When the security alert is triggered, could you check the Logic App trigger history to see if it succeeded or if there were any issues?

Could you please share the expected behavior output with us? This will help us provide a more accurate solution.

Thank you.
Shireesha Eeraboina (Quadrant Resource LLC) 660 Reputation points Microsoft Vendor

2025-01-08T07:43:35.4466667+00:00

Hi @Mike Ter,

I am following up to see if you had a chance to review my previous response and provide the requested information. This will enable us to assist you further.

Thank you.
Samir EL Kaabaoui (DE) 0 Reputation points

2025-01-08T13:27:17.5333333+00:00
Hi @Shireesha Eeraboina (Quadrant Resource LLC)

I currently have the same question or problem.

I have set up the Logic App according to the MS documentation and ARM template, in my case for storage account blobs so that they are deleted when a "Malicious file uploaded to storage account" alert is triggered.

I followed this guide:

https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Workflow%20automation/Delete%20Blob%20LogicApp%20Defender%20for%20Storage

https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation

However, the Logic App is not triggered. When I trigger the Logic App directly via the security alert using the "Take Action" option manually, it works without any issues.

Storage account created and set up according to the documentation.

Logic App created and assigned appropriate RBAC permissions according to the documentation.

Microsoft Defender for Cloud Plan and scan mode set up according to the documentation.

Created and set up a new workflow via Microsoft Defender for Cloud | Workflow automation that should trigger the Logic App, also following the documentation.

A test malicious file was uploaded to the respective storage account -> container.

A security alert is displayed under the storage account in Microsoft Defender for Cloud, but nothing happens afterward; no reaction from the Logic App.

What am I doing wrong or is missing here?

Thanks
Best regards
Samir
Shireesha Eeraboina (Quadrant Resource LLC) 660 Reputation points Microsoft Vendor

2025-01-10T07:49:46.2466667+00:00

Hi @Samir EL Kaabaoui (DE) ,

Thanks for posting your question in Microsoft Q&A, apologize for any inconvenience caused on this.

As from the details that you have mentioned in the thread it is clear that using the Microsoft documents you have configured according to them but please do double check the below points and if the issue still persists, please share the error screenshot or detailed error message that will help us in investigating the issue better.

Ensure that the Managed Identity is properly configured for the Logic App. This involves enabling the system-assigned managed identity and assigning the necessary roles, such as 'Storage Blob Data Contributor', to the Logic App's identity and also Confirm that the Managed Identity has the necessary permissions on the storage account. This can be set up in the Access Control (IAM) section of the storage account.

Also please note that the Azure Blob Storage managed connector has limitations, such as only being able to read or write files that are 50 MB or smaller. Ensure that your Logic App is not hitting these limitations, if you want to know that limitation, please do check the below document:

https://learn.microsoft.com/en-us/azure/connectors/connectors-create-api-azureblobstorage?tabs=consumption

As per the documents mentioned it clearly states that if you're using the legacy trigger When a response to a Microsoft Defender for Cloud alert is triggered, your logic apps won't be launched by the Workflow Automation feature.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation#supported-triggers

I hope the above provided information might help you, if you have any further queries, please feel free to reach out to us.

Thankyou.

Share via

Logic App Workflow Automation Not Triggering for Security Alerts

Your answer