Accessing Azure Key Vault from Power Automate with Firewall Enabled

(1) Share

Report

Posted on by Manh_TruongTien

Hi,

I’m trying to create credentials using Azure Key Vault for later use in Power Automate Desktop.

However, due to our company’s security policy, the Azure Key Vault Firewall is enabled, which currently blocks access from Power Platform services.

According to the documentation below, it’s possible to allow Power Platform IP addresses to access the Key Vault:

Use environment variables for Azure Key Vault secrets - Power Apps | Microsoft Learn

However, it seems that the Azure public IP addresses used by Power Platform change frequently (possibly on a weekly basis),

making it difficult to maintain a stable firewall configuration.

Is there a recommended solution that allows us to keep the Azure Key Vault Firewall enabled while still permitting access from Power Platform?
Thank you in advance for your support.

Best regards,

Categories:

Power Automate Desktop

I have the same question (0)

All responses (4)

Answers (0)

Michael E. Gernaey 53,479 Super User 2025 Season 2 on at

Like (0)

Report

Hi @Manh_TruongTien

They do not change on a weekly basis or that frequently. Can you share who told you that or where you read that?

Was this reply helpful? Yes No
Manh_TruongTien 8 on at

Like (0)

Report

@Michael E. Gernaey Hi
Thank you for your response.

I followed the steps outlined in the articles below.
As noted on the "Azure IP Ranges and Service Tags – Public Cloud" download page, the data is updated weekly.

Do you happen to know how frequently the IP addresses for Power Platform services change?

Also, is there an alternative method to access Azure Key Vault from Power Automate when the firewall is enabled?

１．https://learn.microsoft.com/en-us/power-automate/desktop-flows/create-azurekeyvault-credential#prerequisites
"To configure Azure Key Vault, follow the steps described in Configure Azure Key Vault."
↓
２．https://learn.microsoft.com/en-us/power-apps/maker/data-platform/environmentvariables-azure-key-vault-secrets#configure-azure-key-vault
"6. If you have enabled Azure Key Vault Firewall, you have to allow Power Platform IP addresses access to your key vault. Power Platform isn't included in the "Trusted Services Only" option. Go to Power Platform URLs and IP address ranges for the current IP addresses used in the service."
↓
３．https://learn.microsoft.com/en-us/power-platform/admin/online-requirements#ip-addresses-required
"Azure IP Ranges and Service Tags – Public Cloud"
↓
４．https://www.microsoft.com/en-us/download/details.aspx?id=56519

Thank you again for your support.

Was this reply helpful? Yes No
Michael E. Gernaey 53,479 Super User 2025 Season 2 on at

Like (0)

Report

HI @Manh_TruongTien

So if you read what you highlighted clearly, it states that is for Azure Public all up, it doesn't say that Power Platform changes every week. It is literally talking about every service, every region, every country, every conceivable thing across thousands and thousands of configurations... not power platform specifically.

Was this reply helpful? Yes No
Suggested answer

Power Platform 1919 1,898 on at

Like (0)

Report

Hi @Manh_TruongTien, if your key vault is behind firewall or private endpoint, and your environment is managed environment then we can configure your environment to use Azure Vnet to securely connect to key vault.

Links :

https://learn.microsoft.com/en-us/power-platform/admin/vnet-support-overview

https://github.com/prime-computing-lab/power-app-vnet-integration

Was this reply helpful? Yes No