I’m experiencing an issue with an Azure Logic App (Consumption) where a POST request to the Microsoft Graph API for appRoleAssignment works perfectly when I manually resubmit the failed action, but fails when the Logic App is triggered externally via a webhook.

Here are the details of my setup and the issue:

Logic App Configuration

• HTTP Action Configuration:

{
  "method": "POST",
  "uri": "https://graph.microsoft.com/v1.0/servicePrincipals/{appObjectId}/appRoleAssignments",
  "headers": {
    "Authorization": "Bearer <access_token>",
    "Content-Type": "application/json"
  },
  "body": {
    "principalId": "user-or-service-principal-id",
    "resourceId": "resource-service-principal-id",
    "appRoleId": "app-role-id"
  },
  "retryPolicy": {
    "type": "fixed",
    "interval": "PT5S",
    "count": 3
  },
  "timeout": "PT30S"
}

Error Message
When the Logic App is triggered via a webhook, the request fails with the following error:

{
  "error": {
    "code": "Request_BadRequest",
    "message": "Not a valid reference update.",
    "innerError": {
      "date": "2024-07-18T14:21:29",
      "request-id": "ac44f253-5bbf-48bf-8c8e-c81603fd1320",
      "client-request-id": "ac44f253-5bbf-48bf-8c8e-c81603fd1320"
    }
  }
}

Payload and Headers

• Request Payload:

{
  "principalId": "user-or-service-principal-id",
  "resourceId": "resource-service-principal-id",
  "appRoleId": "app-role-id"
}

• Headers:

{
  "Authorization": "Bearer <access_token>",
  "Content-Type": "application/json"
}

Observations

• The POST requestworks when I manually resubmit the action within the Logic App (from run history).
• The same request fails when triggered externally via a webhook.
• The access token, payload, URI, and headers are verified to be correct.
• The error message suggests a BadRequest due to an invalid reference update.

What could be causing the POST request to fail when the Logic App is invoked externally via a webhook but succeed when manually resubmitted?

I have added logging actions in the Logic App to capture the state before and after the HTTP request. Here is the relevant part of my Logic App flow:

{
  "definition": {
    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
    "actions": {
      "LogBefore": {
        "inputs": {
          "message": "Before HTTP Request: @string(body('WebhookTrigger'))"
        },
        "runAfter": {},
        "type": "Compose"
      },
      "HTTP": {
        "inputs": {
          "method": "POST",
          "uri": "https://graph.microsoft.com/v1.0/servicePrincipals/{appObjectId}/appRoleAssignments",
          "headers": {
            "Authorization": "Bearer <access_token>",
            "Content-Type": "application/json"
          },
          "body": {
            "principalId": "user-or-service-principal-id",
            "resourceId": "resource-service-principal-id",
            "appRoleId": "app-role-id"
          },
          "retryPolicy": {
            "type": "fixed",
            "interval": "PT5S",
            "count": 3
          },
          "timeout": "PT30S"
        },
        "runAfter": {
          "LogBefore": [
            "Succeeded"
          ]
        },
        "type": "Http"
      },
      "LogAfter": {
        "inputs": {
          "message": "After HTTP Request: @string(outputs('HTTP'))"
        },
        "runAfter": {
          "HTTP": [
            "Succeeded"
          ]
        },
        "type": "Compose"
      }
    },
    "contentVersion": "1.0.0.0",
    "outputs": {},
    "triggers": {
      "WebhookTrigger": {
        "inputs": {},
        "kind": "Http",
        "type": "Request"
      }
    }
  },
  "parameters": {}
}

Webhook Request Payload (captured in logs before the HTTP action)

{
  "principalId": "user-or-service-principal-id",
  "resourceId": "resource-service-principal-id",
  "appRoleId": "app-role-id"
}

Webhook Request Headers (captured in logs):

{
  "Authorization": "Bearer <access_token>",
  "Content-Type": "application/json"
}

Update (2024-07-18 18:00):
Upon further investigation, I found that –

• IT FAILS: When I store the appRoleId (a GUID) in a variable and dynamically pass its value to the payload body, then the request fails.
• IT WORKS: If I hard code the GUID for appRoleId in the body itself, then it works (I have copied and pasted the value from the variable).

My guess is that HTTP request to the Graph API is being fired before the Logic App has correctly evaluated the value of the variable.

Update (2024-07-18 18:25): Another interesting fact I forgot to mention is adding retries doesn’t work here, because the error returned in 400. And even if I hard code the GUID of appRoleId in the payload body, it still fails unless I add a delay of at least 25 seconds and then retry the action further down after getting a 400 error. See the screenshot below.