Custom Copilot Connector Does Not Refresh Rotated API Key from Azure Key Vault

(0) Share

Report

Posted on by SS-27070550-0

Hello,

We have built a Custom Copilot Connector in Microsoft Copilot Studio to integrate with a third-party REST API. The third-party application uses API key based authentication. Within the connector, we have implemented custom policies that retrieve the API key from Azure Key Vault and inject it into the request headers at runtime. This part of the setup is functioning correctly, and the connector is able to authenticate and make successful calls to the API using this approach.

The complicating factor is that the third-party API key rotates automatically every 30 minutes. To handle this, we have implemented an automated job that performs the following steps on each rotation cycle:

Retrieves the newly generated API key from the third-party application.
Updates the corresponding secret value in Azure Key Vault.
Refreshes the associated Power Platform connections using pac CLI commands.

Issue observed:
Shortly after the key rotates, subsequent calls to the third-party API begin failing with a 401 Unauthorized error. We have verified that the updated key is present in Azure Key Vault at the time of failure, so the secret itself is correct and current. However, the Custom Copilot Connector continues to authenticate using the previous, now invalid, key. The only way we have found to resolve this is to manually open and update the connector configuration in Copilot Studio, at which point it begins using the new key. This manual step is not practical given the 30 minute rotation interval and the operational overhead it would require.

Question:
Is there a supported mechanism, whether through connector configuration, custom policy adjustments, or pac CLI commands, that would allow the Custom Copilot Connector to automatically retrieve and apply the updated API key from Azure Key Vault without requiring manual intervention on the connector each time the key rotates?

Any insight into whether this is a known limitation, and any recommended workaround, would be greatly appreciated.

Categories:

Calling actions from Copilot Studio

I have the same question (0)

All responses (2)

Answers (0)

Sort by

Mahesh Chintha 168 on at

Like
a
(0)

Report
Copy link

Link copied!

This appears to be a known limitation related to connector/connection credential caching. In our case, We had to redeploy a custom connector when there was a change in the API key to reflect immediately. Updating the secret in Key Vault doesn't necessarily force the custom connector to reload it immediately, which is why manual update/republish causes it to pick up the new key. For frequently rotating keys, an OAuth flow or an intermediary service (APIM/Azure Function) is generally the more reliable approach.

Was this reply helpful? Yes No
Suggested answer

Sayali-MSFT Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Hello SS-27070550-0,

What you're seeing sounds like the connector or connection is caching the authentication configuration rather than re-reading the Key Vault secret on every request. Updating the secret in Azure Key Vault does not necessarily force existing Power Platform connections to refresh and pick up the new value immediately.

If the connector only starts working after manually updating the connector configuration, this suggests the new API key is being resolved when the connection metadata is refreshed, not at runtime per request. Unfortunately, there is no known supported mechanism today to automatically force a custom connector connection to reload a rotated secret every 30 minutes.

As a workaround, consider using a stable authentication layer (such as Azure Function, APIM, or another proxy) that handles the API key rotation and exposes a fixed endpoint to Copilot Studio. That avoids dependency on connector connection refresh behavior.

Was this reply helpful? Yes No