When your Power Platform solution needs Azure: the services worth knowing
Power Platform and Azure integration on one page: which Azure service to reach for when an app, flow or agent outgrows the platform, from custom connectors and Key Vault to private networks, events, search, monitoring, billing and deployment.
Azure + Power PlatformDesign patterns5 min read
Most Power Platform solutions never need Azure. The ones that do usually hit the same few limits: code that a formula can't express, a secret that shouldn't live in a flow, a system on a private network, data that analysts want in a lake, or automation that has outgrown one person's licence. For each of those, Azure has a service that plugs into Power Platform in a supported way. This page is the map: start from what you need, and it points to the service and to our guide that sets it up.
Match the need to the service
| You need to | Use | Set it up |
|---|---|---|
| Run your own code, or call an internal API, from an app, flow or agent | Azure Functions behind a custom connector; Azure API Management to publish many APIs | Azure Function custom connector with Entra ID sign-in |
| Keep passwords and keys out of apps and flows | Azure Key Vault, read through secret environment variables | Fix "User is not authorized to read secrets" |
| Run high-volume or long-running integration that IT owns | Azure Logic Apps | Logic Apps vs Power Automate |
| Reach a database or API that isn't on the internet | Virtual network support for Power Platform | See the notes below |
| Tell other systems when Dataverse data changes | Azure Service Bus or Event Hubs, through Dataverse service endpoints | See the notes below |
| Analyse Dataverse data with other company data | Link to Fabric, or Azure Synapse Link into your own storage | Dataverse to Fabric: Link to Fabric or Azure Synapse Link |
| Run a prompt on a model you chose and deployed | Microsoft Foundry | Use a Foundry model in Copilot Studio prompts |
| Let an agent answer from a large document collection | Azure AI Search as a Copilot Studio knowledge source | See the notes below |
| See every failed flow in one place, and get alerted | Application Insights | Alerts for failed Power Automate flows |
| Pay for occasional users or runs instead of licences | Pay-as-you-go billing on an Azure subscription | Power Platform pay-as-you-go on Azure |
| Deploy solutions from source control with approvals | Azure DevOps or GitHub pipelines | Deploy Power Platform solutions with Azure DevOps or GitHub |
What changes when Azure is involved
- Someone owns the Azure side. Every service here lives in an Azure subscription and resource group, with its own administrators. Agree who that is before the first resource is created, and who is called when it fails.
- There's a second bill. Azure services are billed to the subscription, separately from Power Platform licences. Each guide above says what drives its cost.
- There are two sets of permissions. Power Platform roles and data policies decide who can use a connector; Azure roles decide who can change the resource behind it. Both sides need the same care, and the same Entra ID tenant underpins both.
- Your data policies still apply. Custom connectors and connectors to Azure services are classified in Power Platform data policies like any other connector, so place them deliberately.
Notes on each service
Custom connectors and API Management
A custom connector is how an app, flow or Copilot Studio agent calls an API that has no built-in connector. For one or two Azure Functions, create the connector yourself (our guide above shows it with Entra ID sign-in). For many APIs, publish them in Azure API Management and export them from there: in API Management, open APIs > Power Platform > Create a connector, choose the API and the environment, and the connector appears in Power Apps and Power Automate. To test it from the maker portal's test console, API Management needs a CORS policy allowing https://make.powerapps.com, and the connector needs a policy that sends that origin.
Private networks
Virtual network support lets Dataverse plug-ins and connectors call resources inside your Azure virtual network, and on-premises systems connected to it, without exposing them to the internet. You delegate a subnet to Power Platform (Microsoft.PowerPlatform/enterprisePolicies) in each of the two Azure regions behind your environment's region, link it through an enterprise policy, and apply it to the environment. Plan it carefully:
- An Azure subscription must be associated with your Power Platform tenant.
- Once it's on, calls from plug-ins and connectors go through your network, so calls to public services can start to fail unless your network allows them. Check plug-in and connector code first.
- Turning it on or off can cause up to 30 minutes of instability for those workloads.
Dataverse events into Azure
Dataverse can post the details of an operation, such as "an account was created", to an Azure Service Bus queue or topic, or to Event Hubs, whenever it happens. A developer registers a service endpoint and a step for the table and message with the Plug-in Registration tool. Register it to run asynchronously: a synchronous one sends the message immediately, and if the operation fails afterwards, the message can't be called back.
Search for agents
When an agent needs to answer from more documents than an upload or a SharePoint site handles well, add an Azure AI Search index as a knowledge source in Copilot Studio. The index has to be a vector index (the Import and vectorize data wizard in Azure AI Search builds one), each knowledge source uses one index, and Microsoft asks for a proper data connection, preferably with Entra ID authentication, rather than a pasted key. An index behind a private endpoint works with virtual network support.
Sources
- Export APIs from Azure API Management to the Power Platform, Microsoft Learn
- Enable CORS policies for API Management custom connector, Microsoft Learn
- Virtual network support overview, Microsoft Learn
- Set up virtual network support for Power Platform, Microsoft Learn
- Azure integration for Dataverse, Microsoft Learn
- Work with Dataverse data in your Azure solution, Microsoft Learn
- Add Azure AI Search as a knowledge source, Microsoft Learn
Was this helpful?
Comments
No comments yet. Share what worked for you.
Sign in to comment. Comments show under a display name you choose, never your email.