Changing Passwords and Connectors and Vaults

[CraigSparks37]

Good day Power Automate Users.

When setting up a connector for say, an unattended desktop flow, it appears as the NT Username and Password is required like:

If the password changes, then that implies that we need to come back and edit/recreate the connector.

Is there a way for the connector to dynamically fetch the password to use and not store it in the connector itself?

The same question I have for say the Oracle Connector, like:

Once created, if the password changes, this implies that one needs to come back edit/recreate the connector.

Ideally, having the passwords for VM Remote Desktop Connections for unattended flows, and for db connections, we would like

to store in a vault like Azure Vault or Beyond Trust, and let that manage the passwords, and then connectors reference that.

Which means if the passwords change, the flow continues on its happy way.

Any and all advise and suggestions around this will be appreciated.

Have a fantastic day further.

Craig

[SudeepGhatakNZ]

Hi @CraigSparks37 ,

To achieve dynamic password management for connectors in Power Automate, such as for unattended desktop flows or database connections, you should always integrate with a password management service like Azure Key Vault.

You could either use a secret key or Service principal to access Azure Key Vault from Power Automate. Have you connected to Vault before? This will help

Azure Key Vaults and Power Automate - Powering your Apps (sudeepghatak.com)

[Agnius · Accepted solution]

There's a preview feature allowing the use of Azure Key Vault for fetching credentials for connections. See here: https://learn.microsoft.com/en-us/power-automate/desktop-flows/manage-credentials?wt.mc_id=MVP_30718... 

The current plan is for this to support the desktop flows connector only, but you never know - it might also be expanded to other connectors in the future, too. 

[CraigSparks37]

Thanks @SudeepGhatakNZ 

I have seems the use of Azure Key Vault. It unfortunately still leave me with the question.

How does one, (for example using a desktop flow set to run unattended or Oracle Connection), get the password from vault into the connector used as that is pre setup as a connection.

If the password changes for any reason, the flow will break, until the password is fixed on the connection.

That is what I am trying to see, is that possible in anyway... for passwords to be changed on key vault, used in the connections, so that when it changes, nothing breaks.

I hope I am articulating my question well enough. 🙂

Thanks for your time.

Craig

[SudeepGhatakNZ]

@CraigSparks37 ,

Do you have error handling in your flow?

Could you setup an action to retrieve new credentials from key fault should the connection fail?

Handle errors in desktop flows - Power Automate | Microsoft Learn

[CraigSparks37]

Thank you @Agnius, this pointer solves half of my problem. 

Here is hoping that Micorsoft port this functionality to the rest of the connectors, so that Credential Auth can be used across all connection setups. That way, passwords can we rotated and changed in vault and no one will know any better.

Cheers