Unable to receive call back request on webhook actions when trigger is restricted to specific Ips

Published Apr 29 2021 09:47 AM 874 Views
Senior Member

Scenario 

User has access control configuration enabled on the Logic app with Trigger access restricted to specific IP ranges and using Send Approval email action in the workflow. So when recipient receives an approval email, user isn't able to record the response (like approval/reject). 

 

Cause: 

When we enable the access control for IP ranges by default it inspects all inbound traffic  to Logic App. If source IP isn't part of the restricted Ips ranges then it blocks the traffic. In our case, Connector outgoing IP addresses are not enabled on the restricted IPs.

 

Resolution:  

User can either update the IP ranges on the access control configuration in designer or using ARM template to update the same.

You can find the Logic App outbound /Connectors outbound IP addresses here Logic App outbound-ip-addresses . We need to open the specific outbound Ips with respect to Connector.

 

Logic App Designer:

At present designer has two settings for restricting IP ranges for triggers (Its for both access endpoint and actions call back request) and contents. So, you can enable both the trigger restricted and respective action connector outbound IP addresses in the IP ranges for triggers param.

veerareddy_0-1617784422513.png

 

Using ARM template:

You can also use the ARM template allows to provide the access control configurations for Trigger and Actions separately. You can use IP as IP range (x.x.x.x-x.x.x.x) or CIDR notation (x.x.x.x/x)separated by ',' as an array.

 

{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"name": "[parameters('LogicAppName')]",
"type": "Microsoft.Logic/workflows",
"location": "[parameters('LogicAppLocation')]",
"tags": {
"displayName": "LogicApp"
},
"apiVersion": "2016-06-01",
"properties": {
"definition": {
"<workflow-definition>"
},
"parameters": {
},
"accessControl": {
"triggers": {
"allowedCallerIpAddresses": []
},
"actions": {
"allowedCallerIpAddresses": []
},
// Optional
"contents": {
"allowedCallerIpAddresses": []
}
},
"endpointsConfiguration": {}
}
}
],
"outputs": {}
}

%3CLINGO-SUB%20id%3D%22lingo-sub-2258452%22%20slang%3D%22en-US%22%3EUnable%20to%20receive%20call%20back%20request%20on%20webhook%20actions%20when%20trigger%20is%20restricted%20to%20specific%20Ips%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2258452%22%20slang%3D%22en-US%22%3E%3CH4%20id%3D%22toc-hId-229575450%22%20id%3D%22toc-hId-229575448%22%3E%3CSTRONG%3EScenario%3C%2FSTRONG%3E%3A%26nbsp%3B%3CSTRONG%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FH4%3E%0A%3CP%3EUser%20has%20access%20control%20configuration%20enabled%20on%20the%20Logic%20app%20with%20Trigger%20access%20restricted%20to%20specific%20IP%20ranges%20and%20using%20Send%20Approval%20email%20action%20in%20the%20workflow.%20So%20when%20recipient%20receives%20an%20approval%20email%2C%20user%20isn't%20able%20to%20record%20the%20response%20(like%20approval%2Freject).%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH4%20id%3D%22toc-hId--1577879013%22%20id%3D%22toc-hId--1577879015%22%3E%3CSTRONG%3ECause%3A%26nbsp%3B%3C%2FSTRONG%3E%3C%2FH4%3E%0A%3CP%3EWhen%20we%20enable%20the%20access%20control%20for%20IP%20ranges%20by%20default%20it%20inspects%20all%20inbound%20traffic%26nbsp%3B%20to%20Logic%20App.%20If%20source%20IP%20isn't%20part%20of%20the%20restricted%20Ips%20ranges%20then%20it%20blocks%20the%20traffic.%20In%20our%20case%2C%20Connector%20outgoing%20IP%20addresses%20are%20not%20enabled%20on%20the%20restricted%20IPs.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--1588382117%22%20id%3D%22toc-hId--1588382119%22%3E%3CSTRONG%3EResolution%3A%26nbsp%3B%3C%2FSTRONG%3E%26nbsp%3B%3C%2FH3%3E%0A%3CP%3EUser%20can%20either%20update%20the%20IP%20ranges%20on%20the%20access%20control%20configuration%20in%20designer%20or%20using%20ARM%20template%20to%20update%20the%20same.%3C%2FP%3E%0A%3CP%3EYou%20can%20find%20the%20Logic%20App%20outbound%20%2FConnectors%20outbound%20IP%20addresses%20here%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Flogic-apps%2Flogic-apps-limits-and-config%23outbound-ip-addresses%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3ELogic%20App%20outbound-ip-addresses%3C%2FA%3E%26nbsp%3B.%20We%20need%20to%20open%20the%20specific%20outbound%20Ips%20with%20respect%20to%20Connector.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH5%20id%3D%22toc-hId-1600195294%22%20id%3D%22toc-hId-1600195292%22%3E%3CSTRONG%3ELogic%20App%20Designer%3C%2FSTRONG%3E%3A%3C%2FH5%3E%0A%3CP%3EAt%20present%20designer%20has%20two%20settings%20for%20restricting%20IP%20ranges%20for%20triggers%20(Its%20for%20both%20access%20endpoint%20and%20actions%20call%20back%20request)%20and%20contents.%20So%2C%20you%20can%20enable%20both%20the%20trigger%20restricted%20and%20respective%20action%20connector%20outbound%20IP%20addresses%20in%20the%20IP%20ranges%20for%20triggers%20param.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22veerareddy_0-1617784422513.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F270708iEE3D73DC0B1CB4C1%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22veerareddy_0-1617784422513.png%22%20alt%3D%22veerareddy_0-1617784422513.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH5%20id%3D%22toc-hId--207259169%22%20id%3D%22toc-hId--207259171%22%3E%3CSTRONG%3EUsing%20ARM%20template%3A%3C%2FSTRONG%3E%3C%2FH5%3E%0A%3CP%3EYou%20can%20also%20use%20the%20ARM%20template%20allows%20to%20provide%20the%20access%20control%20configurations%20for%20Trigger%20and%20Actions%20separately.%26nbsp%3BYou%20can%20use%20IP%20as%20IP%20range%20(x.x.x.x-x.x.x.x)%20or%20CIDR%20notation%20(x.x.x.x%2Fx)separated%20by%20'%2C'%20as%20an%20array.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7B%3CBR%20%2F%3E%22%24schema%22%3A%20%22%3CA%20href%3D%22https%3A%2F%2Fschema.management.azure.com%2Fschemas%2F2015-01-01%2FdeploymentTemplate.json%23%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3Ehttps%3A%2F%2Fschema.management.azure.com%2Fschemas%2F2015-01-01%2FdeploymentTemplate.json%23%3C%2FA%3E%22%2C%3CBR%20%2F%3E%22contentVersion%22%3A%20%221.0.0.0%22%2C%3CBR%20%2F%3E%22parameters%22%3A%20%7B%7D%2C%3CBR%20%2F%3E%22variables%22%3A%20%7B%7D%2C%3CBR%20%2F%3E%22resources%22%3A%20%5B%3CBR%20%2F%3E%7B%3CBR%20%2F%3E%22name%22%3A%20%22%5Bparameters('LogicAppName')%5D%22%2C%3CBR%20%2F%3E%22type%22%3A%20%22Microsoft.Logic%2Fworkflows%22%2C%3CBR%20%2F%3E%22location%22%3A%20%22%5Bparameters('LogicAppLocation')%5D%22%2C%3CBR%20%2F%3E%22tags%22%3A%20%7B%3CBR%20%2F%3E%22displayName%22%3A%20%22LogicApp%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22apiVersion%22%3A%20%222016-06-01%22%2C%3CBR%20%2F%3E%22properties%22%3A%20%7B%3CBR%20%2F%3E%22definition%22%3A%20%7B%3CBR%20%2F%3E%22%3CWORKFLOW-DEFINITION%3E%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22parameters%22%3A%20%7B%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22%3CSTRONG%3EaccessControl%3C%2FSTRONG%3E%22%3A%20%7B%3CBR%20%2F%3E%22%3CSTRONG%3Etriggers%3C%2FSTRONG%3E%22%3A%20%7B%3CBR%20%2F%3E%22%3CSTRONG%3EallowedCallerIpAddresses%3C%2FSTRONG%3E%22%3A%20%5B%5D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22%3CSTRONG%3Eactions%3C%2FSTRONG%3E%22%3A%20%7B%3CBR%20%2F%3E%22%3CSTRONG%3EallowedCallerIpAddresses%3C%2FSTRONG%3E%22%3A%20%5B%5D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%2F%2F%20Optional%3CBR%20%2F%3E%22contents%22%3A%20%7B%3CBR%20%2F%3E%22allowedCallerIpAddresses%22%3A%20%5B%5D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22endpointsConfiguration%22%3A%20%7B%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%5D%2C%3CBR%20%2F%3E%22outputs%22%3A%20%7B%7D%3CBR%20%2F%3E%7D%3C%2FWORKFLOW-DEFINITION%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2258452%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22veerareddy_0-1617776960674.jpeg%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F270675i151AD24D664737B1%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22veerareddy_0-1617776960674.jpeg%22%20alt%3D%22veerareddy_0-1617776960674.jpeg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2258452%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ELogic%20Apps%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Co-Authors
Version history
Last update:
‎Apr 07 2021 02:02 AM
Updated by: