Access Key Vault Secret from Plugin

[pdcmagno]

Hi,

Currently, all our key vault secrets are accessible and linked to as Environment Variables. Power Automate flows are able to retrieve these environment variable secrets easily using the RetrieveEnvironmentVariableSecretValue action.

Now what I am aiming for is to retrieve the Environment Variable secrets in Plugins. Unfortunately, RetrieveEnvironmentVariableSecretValue cannot be called directly thru code and only available for Flow use (see link). I thought of the following work around:

1. Create an http request triggered flow, use the RetrieveEnvironmentVariableSecretValue action to retrieve the secret and return the secret value as response. Plugin will call the flow via http request.

- This can work. The only problem is that the flow has to be configured for public use because if this flow is to be configured as accessible only by 'anyone within tenant' or a 'specific user', calling this flow will still require a secret and it will still be the same problem. 

2. Retrieve the secret directly from azure key vault. - This approach will still require a secret. 

Are there any other possible ways I can retrieve key vault secrets in Dataverse plugin?

[ivan_apps · Accepted solution]

I assume you're using C# plugins, not Low-Code plugins.  I have no idea if it's possible with low-code plugins but it should be with C#. 

Take a look at this blog as I think this answers your questions on how to retrieve the secret via plugin: https://itmustbecode.com/azure-key-vault-secrets-in-dataverse/

If you want to retrieve directly from KeyVault, then you'd need an App Registration with the appropriate access to the vault. Put your App Registration Secret into your Secure Configuration when registering the plugin. Your code should then be able to handle the call and authenticate via the app registration to retrieve the Secret value.

[pdcmagno]

Hi Ivan,

Thanks for your response. 

Yes, I am referring to the C# plugin. I have actually looked into the blog you shared before and unfortunately, this is using the RetrieveEnvironmentVariableSecretValue action. Looking at the comment section of the blog, this action seems to work before but later changed to only applicable for Flows and not thru code/api.

[ivan_apps]

that is indeed unfortunate. Your first method of calling power automate via HTTP endpoint should work, I imagine you want to add a custom Access Control List to limit who can execute this flow. Ultimately you will need the Azure App Registration created with sufficient access to the Vault. You put in the Azure App secret directly into the flow or you can force the flow to receive it as a parameter. Use the plug-in secure configs to enter the Azure App Secret and call the flow with your new credentials.

If you are developing in different environments within the same tenant, your app registration just needs an account in each environment but otherwise it doesn’t have to change so you don’t need to store the App secret in environment variables. 

your method #2 is probably a bit more straightforward rather than using power automate as an intermediate. Again an app registration is key, but don’t think that you need to put the secret for it in an EV. Putting it into the secure config should be sufficient. You can still put the Secret in the KeyVault directly for safe keeping but in order to programmatically access the rest of the secrets you have to manage that secret outside of EVs. Otherwise you’re just creating a circular dependency on the KeyVault without having access to retrieve the access key.

[EricRegnier]

Hi @pdcmagno,
Very good question, and I believe it is something in the backlog of the product but no ETA yet. The workaround I use is to leverage Azure aware plugins instead of traditional Dataverse plugins. With Azure aware plugins you can then access anything and add references to any desired library.

You can also vote for the idea here: https://ideas.powerapps.com/d365community/idea/21c23c3b-4972-ee11-a81c-0022484e61f5

Hope this helps!