Key Vault Connector vs Environment Variables for Azure Key Vault Secrets

(0) Share

Report

Posted on by CU01081947-0

716

Hello Power Automate Community,

I hope you can help.

Does anyone know what extra or what the reason is for using the functionality of "use environment variables for Azure Key Vault secrets" vs just using the "Azure Key Vault" connector.

Any insight would be greatly appreciated.

Thanks very much,

Garry

Categories:

Building flows

I have the same question (0)

All responses (4)

Answers (1)

Verified answer

Pstork1 68,717 Most Valuable Professional on at

Like (1)

Report

If you use just the connector then the credentials or auth keys are available in the code. If you use the secrets environment variable then the value used for authorization keys are encrypted in the environment variable. The connector can then retrieve them at runtime but no one else can.

----------------------------------------------------------------------------------
If this Post helped you, please click "Does this answer your question" and give it a like to help others in the community find the answer too!

Paul Papanek Stork, MVP
Blog: https://www.dontpapanic.com/blog

Was this reply helpful? Yes No
CU01081947-0 716 on at

Like (0)

Report

Hello @Pstork1,

Thanks so much for your quick response. That's good to know. I'll go with the environment variable approach then.

Much appreciated,

Garry

Was this reply helpful? Yes No
CU01081947-0 716 on at

Like (0)

Report

Hello @Pstork1,

Sorry, do you mind me asking a follow up question, please?

I think I misunderstood the response, sorry.

I've created the environment variable and can retrieve the secret using the Dataverse connector "Perform an unbound action" as per this document, but I still need to secure the outputs of that action, without it I can see the secret value in the Flow. This was exactly the same for when I used the "Azure Key Vault" connector directly.

So may I ask, where is the benefit to using the environment variable in regards to improving security?

Any ideas would be greatly appreciated. Again, thanks for all your help.

Garry

Was this reply helpful? Yes No
Pstork1 68,717 Most Valuable Professional on at

Like (2)

Report

Yes, you can see it because you created it. The point is that you control who can see and read that value. See this sentence in the first paragraph of the document you referenced. "Notice that the secrets aren't available for use in other customizations or generally via the API." Using just the connector other users can use that connection elsewhere. Using an Environment variable secret they can only use it if they have access to read that key. You control that access by RBAC in Azure Key vault.

----------------------------------------------------------------------------------
If this Post helped you, please click "Does this answer your question" and give it a like to help others in the community find the answer too!

Paul Papanek Stork, MVP
Blog: https://www.dontpapanic.com/blog

Was this reply helpful? Yes No