Key Vault Access Audit Report

Overview

This cloud flow runs weekly to audit access to an Azure Key Vault. It queries Azure Log Analytics for all secret/key access events over the last 7 days, cross-references the accessing identities against an approved-users list, flags any unauthorized or anomalous access, exports the findings to an Excel workbook on SharePoint, and emails a summary audit report to the security team.

The pattern is useful anywhere you need to turn raw Azure diagnostic logs into a scheduled, human-readable compliance report without having to stand up a Sentinel workbook or a dedicated SIEM pipeline.

Use Case

IT admins are typically required to prove — on a recurring cadence — that only approved service principals and users have accessed secrets in a Key Vault. Manually pulling this out of Log Analytics each week is tedious, and most teams want an audit artifact (Excel + email) that can be saved alongside change records or shared with auditors.

This flow automates that end-to-end.

The flow is ideal for teams that:

• Pulls the last 7 days of AzureDiagnostics rows for the target vault
• Checks each accessing identity against an allow-list stored in an environment variable
• Writes a row to Excel for every unauthorized or unrecognized access event
• Sends a formatted audit email summarizing the flagged count

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Install the solution

Import the solution zip into the target Power Platform environment.

Create connections

When prompted, create Outlook and Excel Online connections and map them to the two connection references in the solution.

Populate all 8 environment variables

Provide tenant-specific values for vault name, Log Analytics workspace GUID, approved-users list, security team email, SharePoint site, drive ID, file ID, and Excel table name.

Replace the HTTP action's OAuth credentials

Swap the inline tenant/client ID/client secret for a service principal that has Log Analytics Reader on the workspace and Key Vault Reader on the vault. In production, move the secret into an Azure Key Vault reference or a secure environment variable.

Create the Excel workbook

At the configured SharePoint location, create the workbook with a table matching the AddRowV2 columns: Timestamp, Identity, Operation, ResourceId, CallerIpAddress, ResultType.

Adjust the KQL query

Edit the KQL inside Query_Key_Vault_Access_Logs if you want a different time window, resource scope, or anomaly heuristic (after-hours, new IPs, etc.).

Turn the flow on

The flow ships in the Off state. Enable it only after the previous steps are complete so it does not fire against unconfigured env vars.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

body('Parse_Log_Analytics_Response')?['tables']?[0]?['rows']

item()?[1]

not(contains(variables('varApprovedUsers'), item()?[1]))

variables('varFlaggedCount')