Key Vault Secret Sync to Connection References

Overview

This flow keeps Power Platform credentials in lockstep with Azure Key Vault. On a schedule it reads the current value of a rotated Key Vault secret and propagates it into the mapped Power Platform environment-variable value (Dataverse), upserting the value row (create or update), verifies admin connectivity across environments, and notifies makers in Teams.

Why it matters: secret rotations break Power Platform connections and flows that hold a stale value. Syncing the value automatically prevents failures after rotation, with an end-to-end correlation id for traceability.

Ships Off (demo). Prefer Key Vault-backed environment variables where possible; use this sync where values must be copied.

Use Case

A platform/security team rotates a secret in Key Vault and needs every dependent Power Platform environment variable updated automatically so flows keep working after the rotation. The flow reads the current secret value and writes it to the mapped environment-variable value record in Dataverse, then reports the outcome to makers.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Real-time sync

Replace the daily Recurrence with an Event Grid / Key Vault SecretNewVersionCreated webhook trigger.

Multiple secrets

Extend flowlibs_SecretEnvVarMap and wrap the read/upsert in an Apply to each over the map's keys.

Staged rollout

Use flowlibs_TargetEnvironments (dev to test to prod) and loop the write/verify per environment.

Rollback

On verify failure, revert the env-var value to the prior version and alert.

Inventory

Record which flows reference which secret/env var for impact analysis.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

json(variables('varSecretEnvVarMap'))?[variables('varSecretName')]

greater(length(body('List_Existing_EnvVar_Value')?['value']), 0)

first(body('List_Existing_EnvVar_Value')?['value'])?['environmentvariablevalueid']

/environmentvariabledefinitions(@{variables('varEnvVarDefId')})