The Modern Way to Manage Secrets in Dataverse (and Why You Should Adopt It Now)

Storing secrets in the code (ahem… don’t do it… ever!) or in plain text… sounds quick, right? But it also spells trouble down the road: security risks, deployment headaches, and an ALM cycle that turns into a nightmare.

The good news: you don’t have to put up with that. There’s a secure and elegant way to do it: Azure Key Vault + secret-type environment variables in Dataverse. This duo not only protects your credentials but also helps you move solutions between environments without any drama…

Translated with DeepL.com (free version)

What are environment variables?

Azure Key Vault is Azure’s managed service for securely storing keys, controlling access, auditing their use, and rotating them when necessary.

It will allow us to:

• Store the secret outside of Dataverse, which reduces exposure.
• Control RBAC access: The Dataverse identity must be assigned a set of roles, such as Key Vault Secrets User.
• Audit and rotation: If we need to change the secret, we’ll only have to do so in Key Vault.
• For environment-specific isolation, we should use one Key Vault resource per environment. It is very important not to mix secrets across environments; for example: DEV environment → only secrets from the DEV Key Vault.

How do we set it up?

To begin the setup, open the Azure portal and create a new Key Vault resource. Once you’re in the creation wizard, select the resource group where you want to create it.

Once the Key Vault is deployed, go to the Secrets section and add a new secret with the value you want to store. Save the secret so that it is available.

Next, go to Key Vault Access Settings and enable Azure RBAC mode, which will allow you to manage permissions from Azure.

With RBAC enabled, open the permissions settings in the subscription and register the Microsoft.PowerPlatform provider. This step is necessary for Dataverse to access Key Vault.

Next, assign the Key Vault Secrets User role to the application or managed identity that uses Dataverse, so that it has permission to read the secret.

Now you can go to Power Apps. Go to Solutions and open the solution where you want to use the secret. From there, create a new environment variable of the “secret” type.

Finally, when creating the variable, link it to the secret you generated in Azure Key Vault. You’ll need to select the subscription, the Key Vault, and the secret’s name.

And now you can use your secret-type environment variable! But there’s one thing you should know: you can’t access it the same way you access other variables; you have to do so by running an unlinked Custom API provided by Power Platform called “RetrieveEnvironmentVariableSecretValue.”

Let’s take a look by running this Custom API from a Power Automate flow. Using the “Perform an unlinked action” action, select the action mentioned above and add the name of your secret-type environment variable.

ℹ️

If the service provider user does not have at least read permission on the Azure Key Vault resource, an error will be displayed when creating the secret in Power Platform.

Secret-type environment variables that reference Azure Key Vault are currently limited to use in Power Automate flows, Copilot Studio agents, and custom connectors.