Power automate to azure storage

Sourav 115

Hello,

We are not able to connect using power automate connector to azure storage getting error 403 Authorization failure. This storage account has pvt end point and network setting as selected virtual network.

What could be the cause of this issue and how to fix it ?

Keshavulu Dasari 2,250 Reputation points Microsoft Vendor

2024-11-25T20:07:31.72+00:00
Hi Sourav,
Welcome to Microsoft Q&A Forum. Thanks for posting you query here!
The 403 Authorization failure error when connecting to an Azure Storage account with a private endpoint and selected virtual network settings can be caused by several factors. some common causes and potential solutions: Double-check the configuration settings in your Power Automate flow. Ensure that the connection details (e.g., storage account name, endpoint URL) are correct and match the private endpoint configuration.

Network Configuration: Ensure that the virtual network and subnet where your Power Automate connector is running have the necessary permissions to access the storage account. Verify that the private endpoint is correctly configured and associated with the storage account.

Firewall and Virtual Network Settings: Check the storage account's firewall settings to ensure that the virtual network is allowed access. You might need to add the specific subnet or IP range to the allowed list

Role-Based Access Control (RBAC): Ensure that the user or service principal running the Power Automate flow has the necessary permissions. Assign roles like "Storage Blob Data Contributor" to the user or service principal

Authentication Method: Verify that the authentication method (SAS token, access key, or Azure AD) used in the Power Automate connector is correct and has the necessary permissions

Private Endpoint DNS Configuration: Ensure that the DNS settings for the private endpoint are correctly configured. The private endpoint should resolve to the private IP address within the virtual network

By checking these areas, you should be able to identify and resolve the issue causing the 403 Authorization failure

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you
Sourav 115 Reputation points

2024-11-26T14:25:43.5333333+00:00

We made changes to the azure storage network settings to allow from all network which was previously selected network. How we can allow power automate network specifically instead of allowing all networks ??
Keshavulu Dasari 2,250 Reputation points Microsoft Vendor

2024-11-26T14:48:13.9633333+00:00
Hi Sourav,
To allow Power Automate to access your Azure Storage account without opening it to all networks, you can configure the network settings to allow only the specific IP ranges used by Power Automate.

Identify Power Automate IP Ranges:

Power Automate uses specific IP ranges depending on the region. You can find the list of IP addresses used by Power Automate in the IP address configuration documentation.

Configure Azure Storage Network Settings:

Go to your Azure Storage account in the Azure portal.

Navigate to Networking under the Settings section.

Select Firewalls and virtual networks.

Under Allow access from, choose Selected networks.

Add the IP ranges identified in step 1 to the Allow access from list.

Save the changes.

Allow Trusted Microsoft Services:

In the same Firewalls and virtual networks section, scroll down to Exceptions.

Enable the option to Allow trusted Microsoft services to access this storage account. This ensures that services like Power Automate can access the storage account even if they are not explicitly listed in the IP ranges.

These steps you can restrict access to your Azure Storage account to only the necessary IP ranges used by Power Automate, enhancing security while maintaining functionality
For more information:
https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you
Keshavulu Dasari 2,250 Reputation points Microsoft Vendor

2024-11-27T06:50:01.4166667+00:00

Hi Sourav,
Just following up to see if the below answer helped. Please do consider clicking Accept Answer as accepted answers help community as well. Also, please click on Yes for the survey 'Was the answer helpful'
Sourav 115 Reputation points

2024-11-27T07:25:53.5533333+00:00

Hello - I understand all the 3 steps are required, is that correct? Allowing IP range for a region is still a large range, is there any other way to bring them in same network like a vnet peering or allow very limited IP ?

1 answer

Keshavulu Dasari 2,250 Reputation points Microsoft Vendor

2024-11-28T13:04:21.83+00:00
Hi Sourav,
Apologies for the delayed response, yes you can indeed use Virtual Network integration to securely connect Power Automate to your Azure Storage account without exposing it to a wide range of IP addresses,

Using Virtual Network Integration

Set Up VNet Peering:

VNet Peering allows you to connect two Azure VNets, enabling resources in different VNets to communicate with each other. This can be useful if your Power Automate environment and Azure Storage account are in different VNets.

Follow the Azure VNet Peering guide to set up peering between the VNets.

Configure Private Endpoints:

Private Endpoints allow you to connect to Azure services (like Azure Storage) over a private IP address within your VNet, ensuring that traffic stays within the Azure backbone network.

Set up a private endpoint for your Azure Storage account. This will create a private IP address within your VNet that Power Automate can use to access the storage account.

Detailed steps can be found in the Azure Private Endpoint documentation.

Enable VNet Integration for Power Automate:

Power Automate supports VNet integration, allowing it to securely connect to resources within your VNet.

You can configure this by setting up a virtual network data gateway or using the VNet integration feature in Power Platform. More details are available in the Power Platform VNet support documentation.

To Implement

Create and Configure VNets:

Ensure both your Power Automate environment and Azure Storage account are within VNets that can be peered.

Configure VNet peering between these VNets if they are separate.

Set Up Private Endpoints:

Create a private endpoint for your Azure Storage account within the VNet.

Update the DNS settings to ensure that the storage account's private endpoint can be resolved correctly.

Configure Power Automate:

Use the VNet integration feature to connect Power Automate to your VNet.

Ensure that the necessary permissions and network security rules are in place to allow traffic between Power Automate and the storage account.

you can limit access to your Azure Storage account to only the necessary resources within your VNets, significantly enhancing security while maintaining functionality.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you,

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Please sign in to rate this answer.
Keshavulu Dasari 2,250 Reputation points Microsoft Vendor

2024-11-29T17:22:49.5+00:00

Hi Sourav,
If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you

Keshavulu Dasari 2,250 Reputation points Microsoft Vendor

2024-12-02T07:15:31.95+00:00

Hi Sourav,
Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Power automate to azure storage

1 answer

Your answer