Key Vault-Backed Flow Connection Health Check

Overview

This flow monitors Azure Key Vault secrets used as backing credentials for Power Platform connections. When a Key Vault secret is rotated (updated) but no successful flow runs are detected within a configurable time window, the flow flags the credential as potentially stale and alerts administrators via Microsoft Teams and Outlook email. This helps IT teams proactively identify connections that need re-authentication after secret rotation.

Use Case

Organizations using Azure Key Vault to store credentials for Power Platform connections need a way to detect when secrets have been rotated but the associated connections haven't been re-authenticated. Without this check, flows silently fail after credential rotation. This flow automates that detection and notification loop.

The flow is ideal for teams that:

• IT Admins responsible for credential hygiene across Power Platform environments
• Developers maintaining flows that depend on Key Vault-stored secrets
• Teams adopting routine secret rotation policies who need post-rotation validation

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Set environment variables

Update flowlibs_KeyVaultUrl with your actual Key Vault URL. Set flowlibs_TeamsGroupId and flowlibs_TeamsChannelId to your admin Teams channel. Set flowlibs_ConnectionHealthAlertEmail to your IT admin distribution list.

Configure HTTP authentication

Open the two HTTP actions (List Key Vault Secrets, Get Secret Metadata) and fill in the Active Directory OAuth fields: tenant (your Azure AD tenant ID), clientId (an app registration with Key Vault read access), secret (the app's client secret), and audience (https://vault.azure.net).

Authorize connections

Open the flow in the designer and authorize the Dataverse, Teams, and Outlook connections with an appropriate service account.

Adjust the staleness threshold

The default 72-hour threshold works for weekly secret rotation. For daily rotation, lower to 24-48 hours by editing flowlibs_StaleCredentialThresholdHours.

Turn on the flow

Set the flow state to On — it will run on its weekly recurrence schedule.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

last(split(string(body('Get_Secret_Metadata')?['id']), '/'))

addHours(utcNow(), mul(-1, int(variables('varThresholdHours'))))

statuscode eq 4 and completedon ge {cutoffDateTime}

and(greaterOrEquals(secretUpdated, cutoff), equals(length(body('Query_Recent_Successful_Flow_Sessions')?['value']), 0))