Error deploying Logic App from Azure Portal

Question

Error deploying Logic App from Azure Portal

Sebastián Spinetti 0 Microsoft Employee

I'm getting the following error trying to deploy a new Logic App from Azure Portal using default settings:

{

"code": "BadRequest",

"message": "Creation of storage file share failed with: 'The remote server returned an error: (403) Forbidden.'. Please check if the storage account is accessible.",

"details": [

{

  "message": "Creation of storage file share failed with: 'The remote server returned an error: (403) Forbidden.'. Please check if the storage account is accessible."

},

{

  "code": "BadRequest"

},

{}

]

}

Has anyone run into this before?

Rakesh Mishra 5,925 Reputation points Microsoft External Staff Moderator

2026-01-21T00:27:53.0033333+00:00
Hi @Sebastián Spinetti ,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Could you please check below and share your findings.

Create the file share as a resource in the same template and make it depend on the storage account. Use the ARM resource type Microsoft.Storage/storageAccounts/fileServices/shares so the file share is created after the storage account. Make the file share resource dependsOn the storage account. That avoids a race where the Logic App or portal tries to create/use the share before the storage account exists.

Make the Logic App depend on the file share (and file share depend on storage).
Ensure your Logic App resource has dependsOn references to the file share (and that file share depends on the storage account). This guarantees ordering so the Logic App won't attempt to use the share until it exists.

If you must use private endpoints / networking in the same deployment
Also add dependsOn entries for the private endpoint and any private DNS links so the file share (and the Logic App) are created after network plumbing and DNS are ready. The Logic Apps private-storage troubleshooting doc calls out these timing/network traps.

If the storage account is behind a firewall / private endpoint

EITHER temporarily allow public access while you create the Logic App from the portal (Storage → Networking → Allow access from → All networks), complete the portal deployment, then re-enable your private networking and configure Virtual Network Integration for the logic app.

OR use an ARM template (or IaC) deployment flow that provisions the storage account, private endpoints, file share, and logic app in the correct order — that approach does not require enabling public access.
Pravallika KV 9,495 Reputation points Microsoft External Staff Moderator

2026-01-21T01:53:12.0166667+00:00

Hi Sebastián Spinetti, if your storage account is configured to use private endpoints, ensure that the Logic App can communicate with the storage account properly. You might need to configure private DNS entries and ensure the network plumbing is all set up before deployment.

As mentioned in GitHub issue:

When you secure the storage account by using a virtual network, all of these apps should use the same value for vnetContentShareEnabled (formerly WEBSITE_CONTENTOVERVNET) to ensure that traffic routes consistently through the intended virtual network.
Sebastián Spinetti 0 Reputation points Microsoft Employee

2026-01-21T13:40:23.4166667+00:00

The thing is that this is deploying the Logic App directly from the Marketplace, using all default settings, so it also creates the storage account in the same deployment (no private endpoints / network injection used here). I would expect this to work "by-design"...
Praveen Kumar Gudipudi 1,680 Reputation points Microsoft External Staff Moderator

2026-02-11T09:51:58.6+00:00

Hello @Sebastián Spinetti ,

Could you please confirm the following details:

Is the storage account you're using for the logic app deployment configured with network restrictions?

Additionally, could you specify which authentication method you're using to connect the logic app with the storage account?
Praveen Kumar Gudipudi 1,680 Reputation points Microsoft External Staff Moderator

2026-02-13T08:06:44.62+00:00

Hello @Sebastián Spinetti ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

Rakesh Mishra 5,925 Reputation points Microsoft External Staff Moderator

2026-01-21T00:27:53.0033333+00:00

Hi @Sebastián Spinetti ,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Could you please check below and share your findings.

Create the file share as a resource in the same template and make it depend on the storage account. Use the ARM resource type Microsoft.Storage/storageAccounts/fileServices/shares so the file share is created after the storage account. Make the file share resource dependsOn the storage account. That avoids a race where the Logic App or portal tries to create/use the share before the storage account exists.

Make the Logic App depend on the file share (and file share depend on storage).
Ensure your Logic App resource has dependsOn references to the file share (and that file share depends on the storage account). This guarantees ordering so the Logic App won't attempt to use the share until it exists.

If you must use private endpoints / networking in the same deployment
Also add dependsOn entries for the private endpoint and any private DNS links so the file share (and the Logic App) are created after network plumbing and DNS are ready. The Logic Apps private-storage troubleshooting doc calls out these timing/network traps.

If the storage account is behind a firewall / private endpoint

EITHER temporarily allow public access while you create the Logic App from the portal (Storage → Networking → Allow access from → All networks), complete the portal deployment, then re-enable your private networking and configure Virtual Network Integration for the logic app.

OR use an ARM template (or IaC) deployment flow that provisions the storage account, private endpoints, file share, and logic app in the correct order — that approach does not require enabling public access.
Pravallika KV 9,495 Reputation points Microsoft External Staff Moderator

2026-01-21T01:53:12.0166667+00:00

Hi Sebastián Spinetti, if your storage account is configured to use private endpoints, ensure that the Logic App can communicate with the storage account properly. You might need to configure private DNS entries and ensure the network plumbing is all set up before deployment.

As mentioned in GitHub issue:

When you secure the storage account by using a virtual network, all of these apps should use the same value for vnetContentShareEnabled (formerly WEBSITE_CONTENTOVERVNET) to ensure that traffic routes consistently through the intended virtual network.
Sebastián Spinetti 0 Reputation points Microsoft Employee

2026-01-21T13:40:23.4166667+00:00

The thing is that this is deploying the Logic App directly from the Marketplace, using all default settings, so it also creates the storage account in the same deployment (no private endpoints / network injection used here). I would expect this to work "by-design"...
Praveen Kumar Gudipudi 1,680 Reputation points Microsoft External Staff Moderator

2026-02-11T09:51:58.6+00:00

Hello @Sebastián Spinetti ,

Could you please confirm the following details:

Is the storage account you're using for the logic app deployment configured with network restrictions?

Additionally, could you specify which authentication method you're using to connect the logic app with the storage account?
Praveen Kumar Gudipudi 1,680 Reputation points Microsoft External Staff Moderator

2026-02-13T08:06:44.62+00:00

Hello @Sebastián Spinetti ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

The error you are encountering, "Creation of storage file share failed with: 'The remote server returned an error: (403) Forbidden.'", typically indicates that the Logic App is unable to access the specified storage account. Here are some steps you can take to troubleshoot this issue:

Check Storage Account Accessibility: Ensure that the storage account is accessible and that there are no network restrictions (like firewalls) preventing access.
Permissions: Verify that the account or service principal you are using has the necessary permissions to create file shares in the storage account. You may need to assign the appropriate roles to ensure access.
Storage Account Configuration: Make sure that the storage account is configured correctly and that it is not set to a private endpoint that restricts access.
Review Connection Strings: If you are using connection strings, confirm that they are correct and that any Shared Access Signature (SAS) keys are valid and have not expired.
Retry Deployment: Sometimes, transient issues can cause such errors. Try redeploying the Logic App after verifying the above settings.

If the issue persists, you may want to check the Azure portal for more detailed error messages or logs related to the deployment.

Share via

Error deploying Logic App from Azure Portal

1 answer

Your answer