Question about SFTP - SSH config on Logic App

Nguyen Gia Huy (Hugo) 0 Reputation points
2026-07-14T11:09:05.8266667+00:00

Currently I have created a Logic App - Standard with trigger point When a file is added or modified (SFTP - SSH) which connect to my SFTP azure blob storage, when set the Public network access scope of the blob storage to Enable to all networks, the logic app can connect to the SFTP, but when switching to the Enable from selected networks and I add all the Outbound addresses in the Logic app to the IPv4 Addresses list in the SPTP, the SFPT connect in the Logic app lost connect. What ip do I add to the for the Logic app can connect to the SFTP or what config do I add for it to access when the Public network access scope of the azure blob storage set to Enable from selected networks. Thanks.

Azure Blob Storage
Azure Blob Storage

An Azure service that stores unstructured data in the cloud as blobs.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-07-14T11:09:25.6233333+00:00

    For a Logic App Standard, the IP to allow depends on which SFTP connector is being used:

    1. If using the built-in/In-app SFTP connector in Logic App Standard, the connection runs in the single-tenant environment. With Virtual network integration configured, the outbound connection can use the public IP of the NAT gateway.
    2. If using the shared/managed SFTP-SSH connector, it runs in the multi-tenant environment, so adding the Logic App Standard app outbound IP list is not the correct approach for VNet-routed access.

    For the scenario described, the supported configuration from the available guidance is:

    1. In the Logic App Standard resource, go to Settings > Network > Virtual network integration.
    2. Under Application routing, make sure Outbound internet traffic is selected.
    3. Under Virtual network routing, make sure the NAT gateway is selected.
    4. On the storage account networking side, allow the public IP of the NAT gateway rather than the Logic App outbound IP list.

    If the workflow is using the built-in SFTP connector, this aligns with Logic App Standard behavior because the built-in connector runs in the single-tenant environment and can directly connect by using the app environment networking.

    Also verify these Azure Blob Storage SFTP requirements:

    • SFTP access uses the Blob Storage endpoint (blob.core.windows.net), not the Data Lake endpoint.
    • If access is restricted to selected networks, the firewall/network configuration affects connectivity to Azure Storage endpoints.
    • If connecting from outside Azure or from restricted networks, port 22 must be allowed.

    If the trigger currently uses SFTP-SSH rather than the built-in SFTP connector, switching to the built-in SFTP connector in Logic App Standard is the relevant configuration path when the requirement is to route through the VNet/NAT gateway.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.