Key Vault Access Policy and RBAC Audit

Overview

This flow keeps Azure Key Vault access least-privilege and compliant. On a weekly schedule it reads the vault's access policies straight from the Azure Resource Manager resource, compares every principal against an approved baseline, resolves each principal's identity through Microsoft Entra ID, logs every drift finding to a dedicated Dataverse table, and alerts the security team in Microsoft Teams when unapproved access is detected.

Why it matters: vault access tends to accumulate over time. Regularly diffing live access policies against a maintained baseline catches risky or forgotten grants before they can be exploited, and produces a durable, reportable audit trail.

Ships Off (Stopped). Access policies are read from ARM because the Key Vault connector has no access-policy read operation.

Use Case

Security and IT Admin teams want continuous, hands-off verification that only approved identities hold access to a Key Vault. Instead of manually inspecting the Access policies blade, this flow runs the diff weekly, writes one row per violation for review, and pings the security channel only when something is off.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Add RBAC role-assignment auditing

For RBAC-mode vaults (access policies may be empty), add an ARM call to roleAssignments scoped to the vault and diff those principals the same way.

Auto-remediate

After logging, add an ARM Resources_CreateOrUpdateById step to remove unapproved access policies (gate behind an Approval).

Multi-vault

Change the vault name to a comma list and wrap the read + diff in an outer Apply to each.

JIT check

Flag principals whose grants exceed an approved expiry window.

Reporting

Point Power BI at the findings table for a monthly access-review pack.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

not(contains(variables('varAccessBaseline'), items('Apply_to_each_Access_Policy')?['objectId']))

coalesce(outputs('Get_Key_Vault_Resource')?['body/properties/accessPolicies'], json('[]'))

concat('Keys: ', join(coalesce(items('Apply_to_each_Access_Policy')?['permissions']?['keys'], json('[]')), ','), ' | Secrets: ', join(coalesce(items('Apply_to_each_Access_Policy')?['permissions']?['secrets'], json('[]')), ','))

concat('vaults/', variables('varVaultName'))