Adobe PDF Password-Protect and Secure Distribute

Overview

This flow automatically password-protects sensitive PDFs with Adobe PDF Services (the *Protect PDF* operation) and distributes the encrypted file to its recipient, delivering the open password out-of-band in a separate email so the document and its key never travel together.

Why it matters: Sending unprotected payslips, statements, or confidential reports is a data-leak risk. Automating the protection control enforces it consistently on every document, and out-of-band password delivery means an intercepted email alone cannot open the file.

Build note — Adobe via REST/HTTP, not the connector. The Power Automate Adobe PDF Services connector exposes its file input as a contentOnly multipart parameter that cannot be authored through the API/solution build path. This flow therefore calls the Adobe PDF Services REST API directly with the built-in HTTP action (token -> upload asset -> PUT bytes -> operation/protectpdf -> poll -> download), which needs no connection reference — credentials are passed as a bearer token from environment variables. This is the proven FlowLibs pattern for Adobe transform operations.

Use Case

HR, finance, and compliance teams distributing payslips, bank statements, board packs, or confidential reports want every PDF encrypted before it leaves the organisation, with the password delivered through a separate channel. A user (or an upstream process) drops a PDF into a watched SharePoint library; the flow protects it, archives the protected copy, emails it to the recipient, and sends the password separately.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
SharePoint	shared_sharepointonline	GetOnNewFileItems GetFileContent CreateFile
HHTTP	http	POST /token POST /assets PUT {uploadUri} POST /operation/protectpdf GET status GET {downloadUri}
Office 365 Outlook	shared_office365	SendEmailV2

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

SMS out-of-band delivery

Replace Send Password Out Of Band (Outlook) with a Twilio SendMessage to text the password to the recipient's phone — the strongest separate channel.

Metadata-driven recipient

Instead of the fixed flowlibs_DocumentRecipientEmail, switch the trigger to When a file is created (properties only) and read a RecipientEmail column from the library so each document routes to its own recipient.

Hardened password generation

The demo uses a guid()-derived password. In production, derive it from a known shared secret (e.g. employee DOB + last-4) or generate a strong random value and store it in Key Vault / Azure Function.

Certificate-based protection

For B2B exchange, use Adobe certificate protection instead of a password.

Sensitivity label

Apply a Microsoft Purview (MIP) label in addition to encryption.

Tighten permissions

Edit flowlibs_PdfAllowedPermissions (Adobe values: PRINT_LOW_QUALITY, PRINT_HIGH_QUALITY, EDIT_CONTENT, EDIT_DOCUMENT_ASSEMBLY, EDIT_ANNOTATIONS, EDIT_FILL_AND_SIGN_FORM_FIELDS, COPY_CONTENT). Anything omitted is blocked.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@endsWith(toLower(triggerOutputs()?['body/{FilenameWithExtension}']), '.pdf')

@base64ToBinary(outputs('Get_Source_File_Content')?['body']?['$content'])

@{concat('client_id=',encodeUriComponent(variables('varAdobeClientId')),'&client_secret=',encodeUriComponent(variables('varAdobeClientSecret')))}

@coalesce(outputs('Start_Protect_Job')?['headers']?['location'],outputs('Start_Protect_Job')?['headers']?['Location'])

@or(equals(variables('varJobStatus'),'done'),equals(variables('varJobStatus'),'failed'))

@body('Get_Protect_Job_Status')?['asset']?['downloadUri']

@concat('Flx-',toUpper(substring(replace(guid(),'-',''),0,4)),'-',substring(replace(guid(),'-',''),0,4),'-',toUpper(substring(replace(guid(),'-',''),0,4)))

emailMessage/Attachments = [{ Name: 'protected-<file>', ContentBytes: @{base64(body('Download_Protected_PDF'))} }]

Customize & download