Error occured while reading secret: User is not authorized to read secrets

[kawadep]

My Flow was working fine till Last week. No changes done. User Still has access for Key Vault, Power Apps Solution but still this issue has occurred.

Even Service Principal is not expired not sure why this appeared suddenly.

User has System Admin role.

Error Message is "Error occured while reading secret: User is not authorized to read secrets"

[suchitra_v]

I've encountered the same issue too. The flow was working fine till 16th of June 2023. And it has been failing today. No changes were made to user secret access policies. 

[knunders]

+1

Did you find a solution to this issue?

[knunders]

Hi. Check out the solution HERE! 

tldr: Changes made by Microsoft causing the errors. Please create a new Role Assignment for Key Vault Secrets User.

[suchitra_v]

The above solution from @knunders worked. Thank you!

[bfaye78]

Issue:

Solution:

• Select the Key Vault -> Access Control (IAM)
• From Check Access Tab, select Add role assignment

  Make sure you have the permissions to assign roles

• Assign the Key Vault Secrets User role to the service principal called Dataverse (00000007-0000-0000-c000-000000000000)

Do the same for the user creating or reading the environmental variable.

You might encounter another issue related to authorization. In my case, to troubleshoot the issue, I have enabled logging from the key vault.

From the Insights -> Operations, I could see that the IP address of the caller was not allowed to access the resource.

This is an IP Address from the Power platform infra that belongs to the subnet 20.50.64.0/20 in 20.50.70.0/23

The network address may vary by region. In my case, it's NorthEurope.

https://csstoolkit.azurewebsites.net/ 

To fix the problem, go to Networking and add the PowerPlatformInfra network.

• Appy changes

Results

[devothunder]

you're a lifesaver! thank you!

where are these IP addresses documented? I was following the article https://learn.microsoft.com/en-us/connectors/common/outbound-ip-addresses and the IP address that was blocking me from adding in my AKV environment variable isn't listed there.

are there other IP addresses we need to whitelist? I feel like I'm just putting my finger into the dam here to stop these random leaks!

[bfaye78]

You need to enable auditing in the key vault first.
https://learn.microsoft.com/en-us/azure/key-vault/general/howto-logging?tabs=azure-cli
Perform some tests and go to insight -> Operations
You will see failed operations (403 errors). Read the details to see the blocked Ip address
Copy and paste it here https://csstoolkit.azurewebsites.net/  to get the network address that you will add in your Key vault firewall.