Key Vault Drift and Compliance Reporting

Overview

This flow gives ongoing Azure Key Vault security-posture assurance. On a weekly schedule it inventories every Key Vault in the target subscription via Azure Resource Manager, reads each vault's management-plane configuration (soft-delete, purge protection, RBAC vs access-policy mode, public network access, network default action, soft-delete retention), compares each vault to a configurable JSON security baseline, writes a posture snapshot row per vault to a Dataverse table, and posts an HTML compliance scorecard to a Teams channel. The Dataverse table is the source a Power BI scorecard reads downstream.

Why it matters: misconfigured vaults silently undermine secret security. Continuous, automated posture reporting keeps configuration drift visible and gives security/leadership a recurring compliance scorecard with concrete remediation actions.

Ships Off (demo). Management-plane settings are read via ARM (the Key Vault connector only reads secrets/keys).

Use Case

Security and leadership want a recurring, no-touch Key Vault compliance scorecard: which vaults meet the hardening baseline, which do not, and exactly what to fix on each. The flow runs unattended weekly and lands results in both Teams (visibility) and Dataverse (trendable history for Power BI).

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Multi-subscription

Wrap the list + loop in an outer Foreach over a JSON array of subscription IDs, or call ARM Subscriptions_List first.

Tune the baseline

Edit flowlibs_VaultBaseline to add/remove checks (e.g. drop public-network for dev, raise retention days).

Auto-remediation

For safe fixes (e.g. enabling purge protection), add an ARM Resources_CreateOrUpdateById in the non-compliant branch, gated behind an Approval.

Power BI refresh

Add a Power BI Refresh a dataset action after the loop, or point a report at the Dataverse table directly.

Posture trend

Chart findings count / compliance over snapshot date to show drift over time.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

split(items('Apply_to_each_Vault')?['id'], '/')[4]

concat('vaults/', items('Apply_to_each_Vault')?['name'])

div(sub(length(outputs('Compose_Remediation')), length(replace(outputs('Compose_Remediation'), '; ', ''))), 2)

if(greater(outputs('Compose_FindingsCount'), 0), 'Non-Compliant', 'Compliant')