Key Vault Secret Expiry Monitor

Overview

A scheduled cloud flow that scans an Azure Key Vault on a weekly cadence, identifies any secrets or keys whose validityEndTime falls inside a configurable expiry threshold, writes one Dataverse audit record per expiring item, and notifies the security team via Microsoft Teams and a high-importance Outlook email summary. When nothing is expiring, the flow finishes silently — no inbox/channel noise on healthy weeks.

Use Case

Secrets and keys that quietly expire in production cause page-quality outages. This flow gives the security and platform teams a no-touch weekly heads-up so rotations can be scheduled before anything breaks.

The flow is ideal for teams that:

• Surfaces both secrets and keys (separate connector calls, unified report)
• Tunable lead time via an environment variable (default: 30 days)
• Logs to Dataverse for trend analysis and historical audit
• Sends a single consolidated Teams + email digest per run

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Change the vault

Re-authorize the shared_keyvault connection against the target vault, then update flowlibs_KeyVaultName to match for clearer alert text.

Change the lead time

Edit the flowlibs_SecretExpiryThresholdDays current value. No JSON changes needed — the variable feeds both the threshold filter and the days-remaining math.

Change the cadence

Open the Run Weekly Expiry Scan trigger and adjust frequency / interval / day-of-week / hour. The flow uses Eastern Standard Time by default.

Change recipients

Update flowlibs_AdminTeamsGroupId, flowlibs_AdminTeamsChannelId, or flowlibs_SecurityTeamEmail current values. The variables are hydrated once at the top of every run.

Change the audit destination

Point flowlibs_KeyVaultExpiryTrackingTable to a different entity set name. Both CreateRecord actions reference the env var via the variable, so retargeting is a single edit.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

addDays(utcNow(), variables('varExpiryThresholdDays'))

div(sub(ticks(items('Loop_Through_Secrets')?['validityEndTime']), ticks(utcNow())), 864000000000)

@items('Loop_Through_Secrets')?['validityEndTime']