The problem

I need to trigger a Logic App workflow (Standard model) with a HTTP-request from an instance of Azure Data Factory (ADF). However, my organization requires me to restrict network access to the Logic App so if I use the pre-generated URL for the trigger, the request gets blocked. So how do I configure the pipeline in ADF so that the workflow gets triggered?

What I have tried

Our setup for the Azure resources is as follows:

• public network access for the Logic App is disabled
• the System Managed Identity of the ADF instance has the “Contributor” role for the Logic App
• there’s a private endpoint set up for the Logic App from ADF

To call the HTTP trigger from a Web activity in ADF I used the following parameters:

• URL: Callback URL of the Logic App workflow, without the SAS token part
  (pattern: https://<logicAppName>.azurewebsites.net:443/api/<workflowName>/triggers/manual/invoke?api-version=2022-05-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0)
• Method: POST
• Body: "foo": "bar" (dummy value to satisfy ADF’s requirement for a valid body in a POST request)
• Authentication: System Assigned Managed Identity
• Resource: https://management.azure.com
• Headers:
  • Content-Type: application/json
  • Authorization: Bearer <access_token>

Returns

This call returns the following error code and message:
DirectApiInvalidAuthorizationScheme: The provided authorization token is not valid. The request should have a valid authorization header with 'Bearer' scheme.

Anyone has an idea how to do this?