Views:

Applies to Product- Power Automate

What’s happening?
Unable to access secrets from Azure Key Vault, receiving a 400 error indicating a network configuration issue.


Reason:
This arises when the environment is bound to an Enterprise Policy without a properly set up Subnet Delegation. The enforcement of going through a secure channel is looking for the wrong policy due to a change on the backend.


Resolution:

  1. Enable Subnet Delegation for the Azure Key Vault.
  2. Ensure that the Power Platform environment is a managed environment.
  3. Confirm that the Azure Subscription is in the same tenant as the Power Platform environment.
  4. Configure the Azure Key Vault with the appropriate access policies.
  5. Set up a Virtual Network (VNet) for Power Platform as per the official documentation.
  6. If the environment is linked to a "VNet" Enterprise Policy, follow the instructions for setting up the subnet and creating private endpoints for the Azure Key Vault.
  7. Ensure that the VNet link is enabled in Private DNS Zones if it is not created automatically.
For further details, refer to the official documentation on setting up VNet for Power Platform and configuring Azure Key Vault.