Key Vault Secret Rotation Orchestration

Overview

This flow automates safe, end-to-end rotation of an Azure Key Vault secret on a schedule. It reads the current secret value (for rollback), generates a new value, writes a new secret version, propagates the value to a dependent Azure App Service's application settings, verifies the new version is retrievable, and - if anything fails - rolls back to the previous value. Every run posts a status summary to a Microsoft Teams channel.

Why it matters: manual secret rotation is risky and frequently skipped. An orchestrated rotation with a built-in verification gate and an automatic compensating rollback keeps credentials fresh without breaking the apps that consume them.

Ships Off (Stopped). The new-version write uses the Key Vault data-plane REST API via HTTP (the connector is read-only for secrets).

Use Case

IT Admins and Developers who need regular, reliable rotation of API keys and connection-string secrets stored in Key Vault, where one or more applications consume the secret through their app settings and must stay in sync.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Rotation cadence / on-demand

Adjust the Recurrence, or replace the trigger with a manual/HTTP-request trigger to rotate on demand.

Stronger secret generation

Replace the two-GUID value with your own generator (e.g. an Azure Function or complexity-rule expression).

Multiple dependents

Loop an Apply to each over app services/settings, or set each app setting to a Key Vault reference so propagation is automatic.

Merge-safe app settings

Read existing settings first and merge before the ARM PUT so other settings are preserved.

Zero-downtime overlap

Keep the previous version valid for a grace window (dual-secret overlap) before disabling it.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

concat(guid(),guid())

body('Get_Current_Secret')?['value']

if(equals(body('Get_Rotated_Secret')?['value'], variables('varNewSecretValue')), 'verified', string(div(1,0)))

json(concat('{"', variables('varAppSettingKey'), '":"', variables('varNewSecretValue'), '"}'))