PowerApp 用户无法从 azure 密钥保管库中获取机密（通过 Power Automate）

Question

For a azure keyvault connection in Power Automate I am using an app registration. Users of a PowerApp I made can't seem to get secrets from the azure key vault unless I give them access to the keyvault. I was hoping adding the users to the acces policies in the keyvault would be enough. Is there a way to let users get secrets in a PowerApp (through Power Automate) without giving them full access to the keyvault?

I am trying to do something similar as this

Answer 1

You could grant them the "get" permission only on secrets:

az keyvault set-policy --name myvault --secret-permissions get --upn <user ID/email>

However, a better approach might be to run your application as a service principal (or have middleware service that does - really depends on why users need access to the secrets) and it contact Key Vault directly. That service principal should be given minimal rights - basically the same command as above, except using --spn instead of --upn .