Key Vault Secret Access Anomaly Alert

Overview

This flow detects credential misuse against Azure Key Vault. On a schedule it queries Key Vault diagnostic logs (AuditEvent telemetry shipped to a Log Analytics workspace) for unusual secret-access patterns - access spikes, denied attempts, off-hours access, and access by principals outside an approved baseline. Each flagged event is logged to a Dataverse table and a contextual alert is posted to a security Teams channel.

Why it matters: abnormal vault access can signal a compromised identity or leaked credential. Detecting it within the hour limits blast radius and gives security an auditable trail to investigate.

Ships Off (demo). The Log Analytics query uses the built-in HTTP action with AAD OAuth (no Log Analytics connection required).

Use Case

A security / IT-admin team wants automated alerting on anomalous Key Vault secret access without standing up a full SIEM rule. This flow runs hourly, evaluates the last hour of diagnostics, and pushes only the anomalous events to a Teams channel plus a Dataverse log for later review.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Cadence

Change the hourly recurrence (e.g. every 15 min) and set flowlibs_LookbackHours to match.

Sensitivity

Lower flowlibs_AnomalyAccessThreshold to catch smaller spikes; expand flowlibs_BaselinePrincipals to reduce new-principal noise.

Off-hours window

Adjust the off-hours start/end (UTC) to match your business hours.

Sentinel incident

Add an ARM/HTTP action after the Teams post to open a Microsoft Sentinel incident for escalation.

Auto-remediation

Chain a Key Vault access-policy update or principal disable behind an Approval for high-severity anomalies.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

or(greater(AccessCount, threshold), not(contains(baseline, Principal)), not(equals(ResultSignature,'OK')), equals(IsOffHours,'true'))

extend IsOffHours = (AccessHour >= {start} or AccessHour < {end})

concat('PT', variables('varLookbackHours'), 'H')

guid()