Power Apps Azure Key Vault Connector Sign-in Issue

(0) Share

Report

Posted on by J-Skript

I have a canvas app that uses an in-app power automate flow with custom and built-in connector, connecting to Azure Key Vault, creating/updating/getting secrets.

When a user uses mobile to open up the canvas app, they will encounter a permissions pop-up which will require them to sign into all the required permissions including Azure Key Vault. Upon clicking sign in for Azure Key Vault, it will prompt them to enter the Key Vault name. Once the key vault name is keyed in, they will click create. However, it will only loop them back to the initial pop-up. This ends up as a loop.

Summary:

1. Permissions Pop-up -> Click Sign In on Azure Key Vault

2. Input Key Vault Name -> Click create

3. Goes back to Permissions Pop-up

4. Loops

Please help me out.

Categories:

Building Power Apps

powerappsazuresig...

I have the same question (0)

All responses (3)

Answers (0)

Suggested answer

WillPage 2,307 Super User 2025 Season 2 on at

Like (0)

Report

The chances are your user doesn't have the Key Vaults Secrets User role. You can get around this by going into the landing page of the flow and look at the Run-only users settings on the right. In here you can set the user context for the key vault connector from "provided by the run-only user" to the owner of the flow, which is hopefully a service account.

If you want to get the secret as the run-only user then just create an Entra ID group for KV secrets users and put them in it then go give that group the role on the key vault.

Was this reply helpful? Yes No
J-Skript 2 on at

Like (0)

Report

Hi @WillPage,

Prior to this, I have assigned all my user as Key Vault Secrets Officer in the Azure Key Vault IAM.

I tried your suggestion that is to set the user context for the key vault connector from "provided by the run-only user" to the owner of the flow. However, the issue still persisted.

Was this reply helpful? Yes No
WillPage 2,307 Super User 2025 Season 2 on at

Like (0)

Report

Unsure of your issue in that case, but there's another workaround. You can create an environment variable of the type Secret:

Connect this to your key vault. It will create the connection for your user account.

Now in the flow, instead of using the Azure KV connection directly, use Dataverse "Perform an ubound action" action. The action is RetrieveEnvironmentVariableSecretValue and yje EnvironmentVariableName input is whatever you called the environment variable. You can do all this in the default solution if you're not using solutions and ALM

Was this reply helpful? Yes No