How to get Power Automate to work with Azure Blob Storage sftp that is set to Enabled from selected virtual networks and IP addresses

Question

How to get Power Automate to work with Azure Blob Storage sftp that is set to Enabled from selected virtual networks and IP addresses

Brandon Panasiuk 20

I have set up an Azure Blob Storage sftp that is set to Enabled from selected virtual networks and IP addresses as i am restricting to only specific IP addresses from a vendor. I am trying to set up the Get Blob content automation in power automate, but the connection is failing likely due to the private access setting. How do i still keep it private but allow Power Automate to run its job?

Anonymous

2025-07-17T13:53:39.55+00:00
Hello Brandon Panasiuk

You have a few primary options to allow Power Automate to access your storage account while keeping it private for your vendor's specific IPs: Since your storage account is restricted to "selected virtual networks and IP addresses," it's blocking these public IPs.

Navigate to your Azure Storage Account in the Azure portal.

In the left-hand menu, select "Networking".

Under the "Firewalls and virtual networks" tab, ensure your "Public network access" is set to "Enabled from selected virtual networks and IP addresses".

Crucially, at the bottom of this section, check the box for: "Allow Azure services on the trusted services list to access this storage account."

Please refer this acritical https://learn.microsoft.com/en-us/power-platform/admin/vnet-support-overview

This is often the simplest and most secure solution. Azure Storage has a "trusted services" list that includes Power Automate. After enabling this setting, try running your Power Automate flow again. It should now be able to connect to your storage account and get blob content.

Refer to the Microsoft 365 Common and Office Online IP address ranges documentation. Look for the IP ranges related to "Azure Logic Apps" or "Power Automate" for your specific region.

Hope the above answer helps! Please let us know do you have any further queries.
Brandon Panasiuk 20 Reputation points

2025-07-17T15:49:02.3833333+00:00

Hello, unfortunately these are the only options i have for trusted services. Azure isn't in there.
Brandon Panasiuk 20 Reputation points

2025-07-17T16:15:20.0666667+00:00

I am trying to create an automation that grabs the file from my Firewall blocked SFTP Blob and moves it to my sharepoint site. The Get blob logic app is getting blocked by the firewall. Do you know which option on the trusted resource list will allow this function to work?

1 answer

Your answer

Anonymous

2025-07-17T13:53:39.55+00:00

Hello Brandon Panasiuk

You have a few primary options to allow Power Automate to access your storage account while keeping it private for your vendor's specific IPs: Since your storage account is restricted to "selected virtual networks and IP addresses," it's blocking these public IPs.

Navigate to your Azure Storage Account in the Azure portal.

In the left-hand menu, select "Networking".

Under the "Firewalls and virtual networks" tab, ensure your "Public network access" is set to "Enabled from selected virtual networks and IP addresses".

Crucially, at the bottom of this section, check the box for: "Allow Azure services on the trusted services list to access this storage account."

Please refer this acritical https://learn.microsoft.com/en-us/power-platform/admin/vnet-support-overview

This is often the simplest and most secure solution. Azure Storage has a "trusted services" list that includes Power Automate. After enabling this setting, try running your Power Automate flow again. It should now be able to connect to your storage account and get blob content.

Refer to the Microsoft 365 Common and Office Online IP address ranges documentation. Look for the IP ranges related to "Azure Logic Apps" or "Power Automate" for your specific region.

Hope the above answer helps! Please let us know do you have any further queries.
Brandon Panasiuk 20 Reputation points

2025-07-17T15:49:02.3833333+00:00

Hello, unfortunately these are the only options i have for trusted services. Azure isn't in there.
Brandon Panasiuk 20 Reputation points

2025-07-17T16:15:20.0666667+00:00

I am trying to create an automation that grabs the file from my Firewall blocked SFTP Blob and moves it to my sharepoint site. The Get blob logic app is getting blocked by the firewall. Do you know which option on the trusted resource list will allow this function to work?

Answer 1

Sina Salam 26,666 Volunteer Moderator

Hello Brandon Panasiuk,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to get Power Automate to work with Azure Blob Storage sftp that is set to Enabled from selected virtual networks and IP addresses.

Most of all, if I may ask; what kind of Power Automate connector are you using? Native Azure Blob connector or HTTP/SFTP connector, which directly impacts how your access should be configured.

For now, I will suggest you avoid using SFTP for Power Automate Blob Access because:

Power Automate does not support Azure Blob SFTP directly,
Use the Azure Blob connector for Get Blob Content.
SFTP should only be enabled for external systems (e.g., vendor systems) that need SFTP access.

Instead:

Use Trusted Services setting OR manually add Logic Apps IPs
Keep “Selected networks and IPs” enabled, restrict to vendors and Power Automate IPs
Use Azure Blob Storage connector, not SFTP in Power Automate
Consider Private Endpoint with Logic App in VNet (advanced setup)

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Brandon Panasiuk 20 Reputation points

2025-07-17T16:08:31.04+00:00

Hello, Thank you for your response.

I am trying to create an automation that grabs the file from my Firewall blocked SFTP Blob and moves it to my sharepoint site. The Get blob logic app is getting blocked by the firewall. Do you know which option on the trusted resource list will allow this function to work?
Brandon Panasiuk 20 Reputation points

2025-07-17T16:15:42.9566667+00:00

I am trying to create an automation that grabs the file from my Firewall blocked SFTP Blob and moves it to my sharepoint site. The Get blob logic app is getting blocked by the firewall. Do you know which option on the trusted resource list will allow this function to work?
Sina Salam 26,666 Reputation points Volunteer Moderator

2025-07-17T20:39:39.56+00:00
Hi,

Under Firewalls and virtual networks, scroll down to the Exceptions section.

Enable the option:

"Allow trusted Microsoft services to access this storage account"

If you're still facing issues even after enabling the trusted services exception, consider using Managed Identity in your Logic App and accessing the Blob Storage via HTTP action instead of the built-in Blob connector. This method gives you more control and avoids IP-based restrictions.
Brandon Panasiuk 20 Reputation points

2025-07-17T21:14:05.6233333+00:00

ok, i have that one checked and i still cannot create a connection from the get blob content connector. Any other ideas?
Sina Salam 26,666 Reputation points Volunteer Moderator

2025-07-17T21:22:36.91+00:00
Hi Brandon Panasiuk,

Thank you for your feedback.

As I said:

Instead of using the built-in Blob connector, use Managed Identity with HTTP Action (as recommended) by trying these steps:

Enable System-Assigned Managed Identity on your Logic App.

Assign the Storage Blob Data Reader role to the Logic App’s identity on the storage account.

Use an HTTP action in your Logic App with the following:

Method: GET

URI: https://<your-storage-account>.blob.core.windows.net/<container>/<blob-name>

Authentication: Use Managed Identity

This bypasses the connector’s IP-based restrictions and gives you more control.

However, if you would like to still go with using the built-in Blob connector.

Make sure the Logic App’s outbound IP addresses are added to the allowed list (you can find these in the Logic App’s properties).

Or, use Private Endpoints if you're working in a secure environment.

Success.
Brandon Panasiuk 20 Reputation points

2025-07-17T21:28:42.75+00:00

Can you please provide more details on how to deploy the managed identity option?
Brandon Panasiuk 20 Reputation points

2025-07-17T21:44:06.6366667+00:00

Thank you! Will this method still allow me to use the logic apps to create the get blob content triggers necessary to pull the data out of the secure sftp or is there another way to accomplish that automation?
Anonymous

2025-07-18T11:32:04.8466667+00:00

Hello Brandon Panasiuk

You can refer the Microsoft Documentation on Authenticate access and connections to Azure resources with managed identities in Azure Logic Apps https://learn.microsoft.com/en-us/azure/logic-apps/authenticate-with-managed-identity?tabs=consumption

Logic Apps can utilize Managed Identity to access Azure Blob Storage securely, but they do not directly support creating GET blob content triggers from secure SFTP. Instead, you can use the SFTP connector to retrieve files from SFTP and then upload them to Blob Storage, where you can trigger actions based on blob events. https://learn.microsoft.com/en-us/azure/connectors/connectors-sftp-ssh?tabs=consumption

Hope the above answer helps! Please let us know do you have any further queries.
Brandon Panasiuk 20 Reputation points

2025-07-18T12:56:21.22+00:00

ok thank you, i will try this and reach back out with questions.

Curious though, why wouldn't MS thought of this, seems odd to create all the unnecessary work just to use a trusted MS tool.
Anonymous

2025-07-21T08:06:25.2333333+00:00

Hello Brandon Panasiuk

Just checking in to see if the provided comment helped. if you have any further queries do let us know via comment. we are happy to assist you
Anonymous

2025-07-22T14:36:49.21+00:00

Hello Brandon Panasiuk

I wanted to follow up and see if the provided comment helped. if you have any further queries do let us know via comment. we are happy to assist you

Share via

How to get Power Automate to work with Azure Blob Storage sftp that is set to Enabled from selected virtual networks and IP addresses

1 answer

Your answer