Recent Logic Apps Failures with Defender ATP Steps – "TimeGenerated" No Longer Recognized
Hi everyone, I’ve recently encountered an issue with Logic Apps failing on Defender ATP steps. Requests containing the TimeGenerated parameter no longer work—the column seems to be unrecognized. My code hasn’t changed at all, and the same queries run successfully in Defender 365’s Advanced Hunting. For example, this basic KQL query: DeviceLogonEvents | where TimeGenerated >= ago(30d) | where LogonType != "Local" | where DeviceName !contains ".fr" | where DeviceName !contains "shared-" | where DeviceName !contains "gdc-" | where DeviceName !contains "mon-" | distinct DeviceName Now throws the error: Failed to resolve column or scalar expression named 'TimeGenerated'. Fix semantic errors in your query. Removing TimeGenerated makes the query work again, but this isn’t a viable solution. Notably, the identical query still functions in Defender 365’s Advanced Hunting UI. This issue started affecting a Logic App that runs weekly—it worked on May 11th but failed on May 18th. Questions: Has there been a recent schema change or deprecation of TimeGenerated in Defender ATP's KQL for Logic Apps? Is there an alternative column or syntax we should use now? Are others experiencing this? Any insights or workarounds would be greatly appreciated!
Adding users to an AD group with Azure Functions/Logic Apps
I want to add users to an Entra ID/Azure AD group. The list of users will be retrieved from a REST API call with Azure Functions, and then saved into a database, probably Azure SQL. I'm planning on then using Azure Logic Apps to connect the database to the AD group. How can I make the script run every time the REST API changes? Can I add users to the AD group from SQL? Is there a better way to go about this?For loop getting data from the API and sending all at one to the email
Hi there, Learning Azure Logic Apps for my job. I have a small azure logic app that needs to export API data with and send it to the email. So far all the steps except adding the output body from the HTTP get request to the variable. Yes, seems that it's just rewriting the variable. But how can I append to a variable without rewriting it? Any advice? Here's the actual build idea. Iterating through profile ID's and getting the output for every ID, then I need to be able to push all of that to the email. Next step for me would be to prettify all this, but that's a bit outside this question. Thanks and much appreciated!
Call SAP OData Service in Logic App through On-Premise Data Gateway
Hello, I want to call an Odata Service of my SAP system. The service is only available in the private network, therefore the call only works via an On Premise Data Gateway. This gateway is already set up and works in the Azure Portal. Using a Postman Collection I have built a Custom Connector which I call in my Logic App. The connector is connected via the gateway to a computer which is logged on to the VPN. My problem is that I can't provide the authentication data for the logon to the SAP system and therefore for the call of the OData service. Is there a possibility to include this authentication data in the request? I have already been able to connect successfully to the SAP system via that gateway, but only to call RFC modules, for example. Is there a way to do this with an OData service? What is the best way for calling an on-premise SAP OData Service in a Logic App? Or is there maybe a way to send an Http request via the On Premise Data Gateway? Thank you!
assign an logic apps system assigned managed identity to a role with terraform and arm template
Hi there, i am trying to assign an logic apps system assigned managed identity to a role for starting/stopping a virtual machine. i use terraform to deploy the logic app template like this: resource "azurerm_template_deployment" "myterraformscheduledvmdown" { name = "scheduledvmdown" resource_group_name = "j14t23resources" template_body = <<DEPLOY { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { }, "variables": { }, "resources": [ { "type": "Microsoft.Logic/workflows", "apiVersion": "2019-05-01", "name": "scheduledvmdown", "location": "westus2", "identity": { "type": "SystemAssigned" }, "properties": .... } } ], "outputs": { "appid": { "type": "string", "value": "[reference(resourceId('Microsoft.Logic/workflows/', 'scheduledvmdown'), '2019-05-01', 'Full').Identity.tenantId]" } } } DEPLOY parameters = { } deployment_mode = "Incremental" } output "appid" { value = "${lookup(azurerm_template_deployment.myterraformscheduledvmdown.outputs, "appid")}" } resource "azurerm_role_assignment" "scheduletovmdown" { scope = azurerm_linux_virtual_machine.myterraformvm.id role_definition_name = "Virtual Machine Contributor" principal_id = azurerm_template_deployment.myterraformscheduledvmdown.outputs["appid"] } i get the following error message while trying to deploy: Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="PrincipalNotFound" Message="Principal xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx does not exist in the directory xxxxx-x-x-x-xxxx." my assumption is, that i do not get the right id with the templates Output: "[reference(resourceId('Microsoft.Logic/workflows/', 'scheduledvmdown'), '2019-05-01', 'Full').Identity.tenantId]" do you have any idea what i did wrong? or a nicer approach to assign the apps generated identity to a vm? thanks tbz
Azure Logic App - Slow Performance with Docker Containers/Python
I have a python script that uses an adobe api to fetch web traffic analytics reports and write them to an Azure SQL database. This script takes about 10 minutes to run and complete successfully when run on my local machine. I packaged this up in to a docker container and have the container configured to run in our Azure logic app as seen in the photo. I have the time limit for the container running set to 3 hours (limit setting in the Until loop) and looking at the logs the script gets nowhere near completion. Why do I see such poor performance when running the container in the logic app vs. my local machine? Are there ways to increase resources for logic apps? Any ideas would help, thanks.
"Resource not found" error while using Sharepoint in Logic Apps
Hi All, I have created a Logic App where i want to use the Sharepoint trigger "When a file is created in folder". When i provide the site of Sharepoint and then click Folder Id then it is giving me error "Resource not found". The same thing was working 2 days earlier without any issue and it was showing me the folders hierarchy on sharepoint site. There has not been any change in the permission of the user through which i have connected to sharepoint and the user is Global Administrator on Sharepoint site. Anyone has any suggestion about how it can be resolved? Thanks Vishnu
