Accessing Azure Key Vault from Power Automate with Firewall Enabled

(1) Share

Report

Posted on by Manh_TruongTien

Hi,

I’m trying to create credentials using Azure Key Vault for later use in Power Automate Desktop.

However, due to our company’s security policy, the Azure Key Vault Firewall is enabled, which currently blocks access from Power Platform services.

According to the documentation below, it’s possible to allow Power Platform IP addresses to access the Key Vault:

Use environment variables for Azure Key Vault secrets - Power Apps | Microsoft Learn

However, it seems that the Azure public IP addresses used by Power Platform change frequently (possibly on a weekly basis),

making it difficult to maintain a stable firewall configuration.

Is there a recommended solution that allows us to keep the Azure Key Vault Firewall enabled while still permitting access from Power Platform?
Thank you in advance for your support.

Best regards,

Categories:

Power Automate Desktop

I have the same question (0)

All responses (5)

Answers (0)

Michael E. Gernaey 53,969 Moderator on at

Like (0)

Report
Copy link

Link copied!

Hi @Manh_TruongTien

They do not change on a weekly basis or that frequently. Can you share who told you that or where you read that?

Was this reply helpful? Yes No
Manh_TruongTien 8 on at

Like (0)

Report
Copy link

Link copied!

@Michael E. Gernaey Hi
Thank you for your response.

I followed the steps outlined in the articles below.
As noted on the "Azure IP Ranges and Service Tags – Public Cloud" download page, the data is updated weekly.

Do you happen to know how frequently the IP addresses for Power Platform services change?

Also, is there an alternative method to access Azure Key Vault from Power Automate when the firewall is enabled?

１．https://learn.microsoft.com/en-us/power-automate/desktop-flows/create-azurekeyvault-credential#prerequisites
"To configure Azure Key Vault, follow the steps described in Configure Azure Key Vault."
↓
２．https://learn.microsoft.com/en-us/power-apps/maker/data-platform/environmentvariables-azure-key-vault-secrets#configure-azure-key-vault
"6. If you have enabled Azure Key Vault Firewall, you have to allow Power Platform IP addresses access to your key vault. Power Platform isn't included in the "Trusted Services Only" option. Go to Power Platform URLs and IP address ranges for the current IP addresses used in the service."
↓
３．https://learn.microsoft.com/en-us/power-platform/admin/online-requirements#ip-addresses-required
"Azure IP Ranges and Service Tags – Public Cloud"
↓
４．https://www.microsoft.com/en-us/download/details.aspx?id=56519

Thank you again for your support.

Was this reply helpful? Yes No
Michael E. Gernaey 53,969 Moderator on at

Like (0)

Report
Copy link

Link copied!

HI @Manh_TruongTien

So if you read what you highlighted clearly, it states that is for Azure Public all up, it doesn't say that Power Platform changes every week. It is literally talking about every service, every region, every country, every conceivable thing across thousands and thousands of configurations... not power platform specifically.

Was this reply helpful? Yes No
Suggested answer

Power Platform 1919 2,205 Super User 2026 Season 1 on at

Like (0)

Report
Copy link

Link copied!

Hi @Manh_TruongTien, if your key vault is behind firewall or private endpoint, and your environment is managed environment then we can configure your environment to use Azure Vnet to securely connect to key vault.

Links :

https://learn.microsoft.com/en-us/power-platform/admin/vnet-support-overview

https://github.com/prime-computing-lab/power-app-vnet-integration

Was this reply helpful? Yes No
arpost 464 on at

Like (0)

Report
Copy link

Link copied!

Have there been any changes on this front, or are we still forced into either VNET approach or nothing with restricted/firewalled Azure Key Vaults? It's crazy to me that this isn't baked in by Microsoft given that Power Platform is supposed to be low-code/no-code.

Was this reply helpful? Yes No