Connector Setup & Configuration

Architecture

The Vault Platform Connector uses a single-tenant, service-to-service architecture. Each organization's Power Platform environment connects directly to its own Dispatcher - there is no shared Refract Logic infrastructure in the data path.

Power Automate Flow
      │
      ▼
Vault Platform Connector (Power Platform)
      │  reads 5 connection parameters
      │  acquires access token from Microsoft Entra ID
      ▼
Customer-hosted Vault Dispatcher (Azure Function App)
      │  validates JWT claims (iss, aud, tid)
      ▼
Vault Platform Services
  ├── PDF Generation
  ├── e-Signature Processing
  ├── Approval Workflows
  ├── Audit & Compliance
  └── Document Storage (Blob / SharePoint)

Data sovereignty: OAuth tokens are issued by the customer's own Microsoft Entra ID tenant. Documents and business data remain within the customer's Azure subscription at all times.

Prerequisites

Before creating a connection:

1. Vault Platform Dispatcher deployed and running in the customer's Azure subscription
2. Microsoft Entra ID App Registration created for the Power Platform connector gateway entry (see below)
3. Power Platform environment with System Administrator or Environment Maker permissions

Step 1: Create the App Registration

The connector authenticates using a dedicated App Registration in the customer's Microsoft Entra ID tenant.

api://<dispatcher-app-client-id>/.default

Step 2: Create a Connection

Once the connector is deployed, it appears in the Power Automate custom connectors list and flow makers can create connections.

Flow makers create connections using the five credential fields.

Open Power Automate

Go to make.powerautomate.com → Data → Connections → + New connection.

Find and Select Vault Platform

Search for Vault Platform. Select the connector.

Enter the Five Fields

Parameter	Description	Example
Dispatcher URL	Dispatcher Function App base URL - no /api suffix	https://func-vaultpdf-contoso.azurewebsites.net
Microsoft Entra Tenant ID	Organization's Microsoft Entra ID tenant GUID	c49962a1-53d3-4af8-8d5d-35f34cd0be9c
Client ID	App Registration (client) ID	9575c697-a0c8-44be-b5d4-20f62473e872
Client Secret	App Registration client secret value	(stored encrypted - not visible after entry)
OAuth Scope	Dispatcher App Registration scope	api://<dispatcher-app-client-id>/.default

Dispatcher URL must not include /api

Enter https://func-vaultpdf-contoso.azurewebsites.net - the connector appends /api/ to all request paths automatically. If you include /api in the URL the requests will fail with 404.

Click Create

No sign-in window appears. The connection is created immediately using the client credentials you entered. A green checkmark confirms the connection is ready.

Connection Parameter Reference

Authentication Model

The Vault Platform Connector uses Microsoft Entra ID client credentials (service-to-service authentication).

Unlike delegated OAuth connectors, there is no interactive user sign-in or browser popup. During connection setup, administrators provide the Microsoft Entra ID application details and the connector acquires access tokens automatically for each API request.

The clientSecret is never forwarded to the Dispatcher - it is used only to acquire the token and is then stripped from the request.

JWT Validation

Before processing any request, the Dispatcher validates:

• Issuer (iss) - Token must be issued by the authorised Microsoft Entra ID tenant.
• Audience (aud) - Token must be intended for the Dispatcher's application registration.
• Tenant ID (tid) - Token must belong to the authorised tenant.

All three validations must succeed. Tokens issued for another tenant or another application are rejected before request processing begins.

Execution Model

The connector performs token acquisition and request forwarding through a lightweight execution layer.

The execution layer has a 5-second CPU limit; however, time spent waiting for Microsoft Entra ID token issuance or Dispatcher processing does not count against this limit.

In practice, the effective limit is the Power Automate action timeout (typically 120 seconds). Most document generation operations complete within 5-20 seconds depending on template complexity and payload size.

Dispatcher Environment Variables

The Dispatcher Function App must have these environment variables configured:

Multiple Environments

Create a separate connection for each environment (dev, test, prod). Each connection can point to a different Dispatcher URL while sharing the same App Registration, or use separate App Registrations per environment.

Deployment Checklist

Before going to production:

• App Registration created and client secret noted
• Dispatcher administrator has registered the App Registration as a gateway entry
• Dispatcher env vars set: JWT_REQUIRED=true, JWT_ISSUER, JWT_AUDIENCE, AZURE_TENANT_ID
• Connector deployed via PAC CLI - 5 policyTemplateInstances confirmed in downloaded apiProperties.json
• Test connection created and green checkmark confirmed
• Generate Document action tested end-to-end with a real template and payload
• Error handling implemented in flows (Configure run after → failed)
• Client secret expiry date calendared for renewal

Troubleshooting

Next Steps

• Overview & Quick Start - Build your first flow
• API Reference - Complete parameter definitions and response schemas
• Trust Center - Security controls and compliance documentation
• Privacy Policy - Data processing and protection
• Terms of Service - Legal terms of use