Secure Data Management in Power Automate Flows

Importance of Secure Data Management

In today’s digital age, securing sensitive data is more critical than ever. With Power Automate, businesses can streamline workflows and automate processes, but how can they ensure their data remains protected? Data breaches can lead to severe financial losses, reputational damage, and legal consequences. Therefore, it’s vital to implement robust data protection measures within Power Automate flows to safeguard sensitive information.

This blog post will explore secure data handling in Power Automate, focusing on using Key Vault and best practices for protecting sensitive data. We’ll cover essential techniques and strategies to ensure your Power Automate flows adhere to the highest data security standards.

By the end of this post, you’ll have a better understanding of how to implement secure data management in Power Automate, ensuring compliance and robust data protection for your workflows.

Understanding Azure Key Vault for Power Automate Flows

Azure Key Vault is a cloud service for securely storing and accessing secrets, keys, and certificates. It provides a centralized solution for managing sensitive information, ensuring that your data is encrypted and access is tightly controlled.

Although Azure Key Vault isn’t part of the Power Platform itself, it’s a valuable resource on Azure that integrates seamlessly with Power Automate. This integration allows Power Platform users to leverage Azure Key Vault for secure data management. Access to Azure Key Vault is managed using Role-Based Access Control (RBAC) via Entra ID, ensuring that you can implement the principle of least-privileged access.

While Azure Key Vault supports both RBAC and access policies, Power Platform currently only supports RBAC. This is in line with Microsoft’s recommendations.

For this blog post example we’ll make a secret key “HsbcApiKey”:

Key Vault Integration Connector

The Azure Key Vault connector for Power Automate allows you to access Azure Key Vault values during execution. This setup is easy and straightforward.

Design Advantages:

• Easy Setup: No need for extensive solution management.
• Dynamic Values: Fetch values on the fly, ideal for frequently changing values or when you need to retrieve a dynamic secret name.

Design Disadvantages:

• Frequent Calls: Requires a call to Key Vault every time the flow runs.
• Visibility of Issues: Problems with the setup or configuration are only visible during execution.
• Rate Limits: Microsoft imposes limits on the number of GET calls per 10 seconds for secrets.
• Cost: You will be billed for every 10,000 transactions to Key Vault. See Key Vault pricing for details.

Setting Up Power Automate Flow with Azure Key Vault for Entra ID Authentication

This is the easiest setup. We’ll create a connection and use our Entra login to authorize access to Key Vault.

Step-by-Step Guide:

1. Assign Rights in Key Vault: Navigate to your Key Vault in the Azure portal and assign the appropriate roles (e.g., Key Vault Reader, Key Vault Secrets User) to your Entra ID. In the screenshot below I’m a “key vault administrator” as I want to create secret values as well.

2. Configure the Connector: In Power Automate, add the Azure Key Vault connector and authenticate using your Entra ID credentials.

3. Fetch Secrets: Use the connector to retrieve secrets dynamically during flow execution.

Key Vault Integration with Environment Variables

Integrating Power Automate with environment variables can be a bit more challenging compared to simpler examples. This integration is only possible when a Power Automate flow is attached to a solution. Solutions contain environment variables that enable application lifecycle management (ALM), allowing you to move configurations and values across multiple environments.

Design Advantages:

• Deployment Feedback: If the connectivity is incorrect, you will see an exception before the flow runs.
• Reusable Solution: Can be used across multiple flows.

Design Disadvantages:

• Requires Solution Management: Involves more complexity and management effort.
• Technical Account Access: The Dataverse technical account will have access to your Key Vault. This means you cannot assign different users for access rights to different Key Vaults.

Setting Up Power Automate Flow with Azure Key Vault Environment Variables – Step by Step

1. Assign Access Rights to Dataverse:
   • Dataverse needs “Key Vault Reader” and “Key Vault Secrets User” access.
   • Assigning these rights can take some time to reflect in Dataverse. So, take a coffee break now!

1. Set Up the Environment Variable:
   • In Power Automate, create a new solution if you don’t already have one.
   • Define environment variables within the solution for storing Key Vault secrets.
   • Reference the environment variables within your flows to securely access secrets.

For more detailed information about Key Vault environment variables for Power Automate, refer to the official documentation here.

Secure Input and Output

In Power Platform flows, anyone with view rights can see all the sensitive data flowing through. This includes data from integrations with services like Key Vault, where secret data is stored. So, how do we protect sensitive data from being visible in run history?

Using secure input and output settings can help. These settings hide sensitive data when viewing the flow’s run history:

• Input: Hides all data passed to the connector.
• Output: Hides all data received from the connector.

For example, by hiding the output of the GetSecret action, the run history will show: “Content not shown due to security configuration.”

To enable secure input and output, follow these steps:

1. Navigate to the Flow: Open the flow in Power Automate.
2. Select the Action: Click on the action where you want to hide sensitive data.
3. Enable Secure Settings: Under ‘Settings’, toggle ‘Secure Inputs’ and ‘Secure Outputs’ to ‘On’.

4. Verify Configuration: Run the flow and check the run history to ensure sensitive data is hidden.

For more details on secure input and output in Power Automate, refer to the official documentation here.

Conclusion

By following these best practices and leveraging Azure Key Vault, you can enhance the security of your Power Automate flows. Remember, securing data is an ongoing process, so stay informed about the latest security updates and recommendations. For more detailed information, check out the official documentation and continue exploring ways to protect your data.

Additional Resources

• Azure Key Vault Documentation
• Best Practices for Azure Key Vault