Key Vault Secret Expiry Rotation Alert

Overview

This flow proactively guards against a common cause of production outages in integration-heavy tenants: an expired secret nobody was watching. On a daily recurrence it enumerates every secret in a target Azure Key Vault (metadata only, no secret values are read), computes each secret's days-to-expiry from its attributes.exp epoch, and surfaces anything inside a configurable window through a tiered notification: a Teams channel post for the platform team plus a high-importance Outlook email to the secret owner / platform fallback address. Every near-expiry secret is also written to a Dataverse audit table, and a single end-of-run digest email summarizes the run. Key Vault has no native granular secret-expiry notification that routes to a human queue; this flow puts the warning in front of the right person while there is still time to rotate, and keeps a Dataverse audit trail for compliance.

Use Case

Platform and security teams that store API keys, connection strings, and certificates in Key Vault need lead time before a secret lapses. This flow gives a configurable runway (default 30 days), escalates urgency as the date approaches via a 3-day / 14-day / 30-day severity tier, and keeps a Dataverse record of every alert so rotation can be audited.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Azure Key Vault	shared_keyvault	ListSecrets
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord
Microsoft Teams	shared_teams	PostMessageToConversation
Office 365 Outlook	shared_office365	SendEmailV2

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Point at your vault

Set flowlibs_KeyVaultName and authorize the Key Vault connection against a principal with List + Get on secrets.

Tune the window

Lower flowlibs_SecretExpiryThresholdDays for earlier warnings, raise it for fewer.

Set the alert routing

Populate flowlibs_TeamsGroupId / flowlibs_TeamsChannelId for the platform channel and flowlibs_PlatformTeamEmail for the digest/fallback recipient.

Per-secret owner routing

Store an owner tag on each secret and add a GetSecret call to read tags, falling back to flowlibs_PlatformTeamEmail.

Cover certificates too

Clone the loop using the Key Vault ListKeys operation; for certificates (no connector op), call Graph/ARM over HTTP to extend coverage.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@div(sub(item()?['attributes']?['exp'], div(sub(ticks(utcNow()), ticks('1970-01-01')), 10000000)), 86400)

@and(not(equals(item()?['attributes']?['exp'], null)), lessOrEquals(outputs('Compose_Days_Remaining'), variables('varWarnDays')))

@if(lessOrEquals(outputs('Compose_Days_Remaining'),3),'Critical',if(lessOrEquals(outputs('Compose_Days_Remaining'),14),'High','Warning'))

@addSeconds('1970-01-01T00:00:00Z', int(item()?['attributes']?['exp']))

Customize & download