Firewall Settings for the Azure Logic Apps Agent
The Nodinite Azure Logic Apps Logging and Monitoring Agent talks to Nodinite, to SQL Server, and to several Azure services, and each hop needs its own firewall rule. A missed rule rarely gives a clear error: logging just stops, or a Logic App shows as unavailable. This page is the one home for the ports of this agent, hop by hop; the Prerequisites hub, the Install, Configuration, and Troubleshooting pages link here.
Every hop at a glance
In Nodinite v7 on Windows Server, every Core Service and every agent is its own IIS web site with its own port, set per environment in the Nodinite Portal (Servers step for the Core Services, Agents step for the agent). The diagram shows the agent on its own server, so that every hop is visible:
IIS web site"] end subgraph SQL["fa:fa-database SQL Server"] CDB["Configuration Database"] LDB["Log Databases"] ADB["Agent Database"] end subgraph AZ["fa:fa-cloud Target: Azure"] ENTRA["Microsoft Entra ID
login.microsoftonline.com"] ARM["Azure Resource Manager
management.azure.com"] RH["Run history content
*.logic.azure.com, *.azurewebsites.net"] EH["Event Hubs
*.servicebus.windows.net"] ST["Storage
*.blob.core.windows.net"] end subgraph NET["fa:fa-network-wired Network services"] DNS["DNS"] PX["Proxy, optional"] end MS -->|"Agent port (Portal)"| AG AG -->|"Log API port (Portal)"| LAPI AG -->|1433| ADB MS -->|1433| CDB LAPI -->|1433| LDB LS -->|1433| LDB AG -->|443| ENTRA AG -->|443| ARM AG -->|443| RH AG -->|"5671, 5672 or 443"| EH AG -->|443| ST AG -->|53| DNS AG -.->|"Proxy port"| PX
Diagram: Every arrow starts at the side that opens the connection and shows its port. The Monitoring Service, Log API, and Logging Service run on the Core Services Server; the Agent Database, Configuration Database, and Log Databases on SQL Server.
Note
When the agent runs on the Core Services Server, which is the typical v7 installation, the hops between the Monitoring Service, the Log API, and the agent stay on the same server, and no firewall rule is needed between them. The Web Client and Web API reach the agent only through the Monitoring Service.
Important
Stateful firewalls: Windows Firewall and most network firewalls are stateful, so response traffic for an outbound connection is allowed automatically. The tables list only the direction that opens each connection.
Between the Monitoring Service and the Logic Apps agent
| Direction | Source | Destination | Protocol | Port(s) | Purpose | Notes |
|---|---|---|---|---|---|---|
| Inbound | Core Services Server | Agent Server | TCP, HTTP or HTTPS | Agent port, set per environment in the Portal | Monitoring, remote actions, and remote configuration | v7. Only when the agent is on another server. Use HTTPS; see hardening |
| Inbound | Core Services Server | Agent Server | TCP | 8000 | Monitoring Service to agent | ⚠️ Legacy v6 Windows Service only |
| Outbound | Core Services Server and Agent Server | Azure Relay, *.servicebus.windows.net |
TCP | 443, 5671, 5672, 9350 to 9354 | Service Bus Relaying when Nodinite and the agent are on different networks | Only with relayed connections; see 'Azure Relay FAQs'. Ports 9350 to 9354 belong to the relay, not to the Event Hubs |
Between the Logic Apps agent and the Log API
| Direction | Source | Destination | Protocol | Port(s) | Purpose | Notes |
|---|---|---|---|---|---|---|
| Outbound | Agent Server | Core Services Server | TCP, HTTP or HTTPS | Log API port, set per environment in the Portal | Post Log Events | The URL is the LogAPI URI on the Logging tab, for example https://nodinite.contoso.com:40002/LogAPI/. There is no fixed 80 or 443 default in v7 |
Between the Logic Apps agent and SQL Server
| Direction | Source | Destination | Protocol | Port(s) | Purpose | Notes |
|---|---|---|---|---|---|---|
| Outbound | Agent Server | SQL Server | TCP | 1433 | Agent Database | 1433 is the default instance port. A named instance uses its own port, and UDP 1434 for SQL Server Browser if you don't set the port in the connection string |
Between the Logic Apps agent and Azure
The agent opens every connection to Azure; no inbound rule is needed in Azure.
| Direction | Source | Destination | Protocol | Port(s) | Purpose | Notes |
|---|---|---|---|---|---|---|
| Outbound | Agent Server | Microsoft Entra ID, login.microsoftonline.com |
TCP, HTTPS | 443 | Get tokens for the App Registration | Required for all features |
| Outbound | Agent Server | Azure Resource Manager, management.azure.com |
TCP, HTTPS | 443 | Azure REST API: discovery, monitoring, run history, remote actions | Required for all features |
| Outbound | Agent Server | Run history content: *.logic.azure.com (Consumption), <logic-app-name>.azurewebsites.net (Standard) |
TCP, HTTPS | 443 | Download the input and output payloads of logged Actions | Logging with payloads. If the workflow restricts run history access by caller IP, add the Agent Server's outbound IP address; see Secure access to run history data |
| Outbound | Agent Server | Event Hubs namespace, <namespace>.servicebus.windows.net |
TCP, AMQP over TLS | 5671, 5672 | Read the diagnostic stream | Logging and failed runs. See AMQP Port Configuration - 5671 and 5672 |
| Outbound | Agent Server | Event Hubs namespace, <namespace>.servicebus.windows.net |
TCP, HTTPS | 443 | Event Hubs management operations, and AMQP over WebSockets | Always needed with AMQP. When only 443 is open, AMQP over WebSockets is the alternative; see the Event Hubs firewall FAQ |
| Outbound | Agent Server | Storage account, <account>.blob.core.windows.net |
TCP, HTTPS | 443 | Read and write the checkpoint | Logging and failed runs |
Tip
Resource firewalls in Azure can block the agent even when your own firewall allows the traffic: Event Hubs IP filters, Storage account firewalls, network access restrictions on Standard Logic Apps, and Private Endpoints. Add the Agent Server's outbound IP address or network to each one; see Configure Azure Storage firewalls and virtual networks and Troubleshoot connectivity issues - Azure Event Hubs. To use the Azure portal through a firewall or proxy, see Safelist the Azure portal URLs on your firewall or proxy server.
Between the Core Services and SQL Server
These hops are not specific to this agent, but Logging fails without them.
| Direction | Source | Destination | Protocol | Port(s) | Purpose | Notes |
|---|---|---|---|---|---|---|
| Outbound | Core Services Server | SQL Server | TCP | 1433 | Monitoring Service, Log API, and Logging Service to the Configuration Database and the Log Databases | Named instances: see the SQL Server note above |
DNS and proxy
| Direction | Source | Destination | Protocol | Port(s) | Purpose | Notes |
|---|---|---|---|---|---|---|
| Outbound | Agent Server | DNS server | TCP and UDP | 53 | Resolve the Core Services Server, SQL Server, and all Azure hostnames | You can use the local hosts file for internal names, but not for Azure hostnames |
| Outbound | Agent Server | Proxy server | TCP | Your proxy port | Reach Event Hubs through the WebProxy set on an Event Hub entry | Optional. Allow the Azure hostnames above on the proxy |