Sync Tempo plans to Outlook through Azure verification

Send Tempo planning to Outlook through an Azure Function that verifies each request's HMAC signature before calling an identity-restricted Power Automate flow.

Before you start

You need an Azure administrator who can deploy a Function App, configure its system-assigned managed identity and grant access to a Key Vault secret. You also need a Power Automate licence/environment supporting the authenticated HTTP trigger and Outlook connector, and an Outlook connection with access to a separate test calendar. This example targets Microsoft public cloud.

The path is Planning Sync → Azure HMAC verifier → identity-restricted Power Automate flow → Outlook. The Function verifies the exact signed request bytes. Its managed identity authenticates the second hop; the Outlook connection still controls calendar access.

1. Download the Azure examples

planning-sync-outlook-azure-example.zip is the Power Automate import package. Its package and flow name are Planning Sync Outlook Azure verifier. planning-sync-azure-verifier-source.zip is a separate Function deployment source package; do not import it into Power Automate.

These are example artifacts to configure and test in your environment. The flow initially denies all callers through an unusable placeholder identity. The direct flow ZIP belongs to the other recipe and uses different authentication.

The Azure flow includes optional planning descriptions in both calendar writes and preview comparisons. Descriptions are escaped so characters such as angle brackets remain literal text.

Power Automate import ZIP

planning-sync-outlook-azure-example.zip

Azure Function deployment source ZIP

planning-sync-azure-verifier-source.zip

2. Import the flow and choose the calendar

Create a separate Outlook test calendar. In Power Automate, open My flows → Import → Import Package (Legacy), upload the Azure flow ZIP, choose Create as new, and select the intended Outlook connection. Keep the flow off while configuring it.

In Recipe configuration → Inputs, set calendarName to the exact calendar name and timeZone to a timezone supported by the Outlook action. Preserve the complete occurrence ID and its matching rules.

3. Prepare the Azure Function and signing secret

1. Use an approved HTTPS Function App with Node.js 22 and a system-assigned managed identity. Record that identity's object ID for the Power Automate allowlist.

2. Create a random signing secret of at least 32 bytes in Key Vault. Grant the Function identity access only to the required secret. Set PLANNING_SYNC_SHARED_SECRET through a Key Vault reference and verify that it resolves.

3. Deploy the verifier source package using the deployment procedure for your Azure hosting plan. The source ZIP needs dependency installation during deployment. Confirm successful deployment before testing. When upgrading an existing Function, deploy the latest source ZIP, wait for the build to finish successfully, then refresh any saved Planning Sync preview before sending.

For Azure product steps, see Key Vault references and Flex Consumption deployment.

4. Restrict the Power Automate HTTP trigger

In When an HTTP request is received → Who can trigger the flow?, choose Specific users in my tenant. Replace the zero-identity placeholder with the Function managed identity's object ID. Do not substitute its application/client ID, clear the allowlist, or choose Anyone.

Save the flow and configure its authenticated URL in the Function setting PLANNING_SYNC_FLOW_URL. This must not be a signed callback URL containing a sig parameter. The Function obtains a token using managed identity, without a manually maintained client secret. For public cloud, Power Automate requires the audience https://service.flow.microsoft.com/. See Microsoft's trigger authentication guidance.

The Function uses HMAC authentication rather than an Azure function key. Its anonymous Functions authorization setting does not remove the HMAC check; the Power Automate trigger must remain restricted to the Function identity.

5. Connect Planning Sync

Once Azure access is enabled for your installation, configure the destination with the Function's HTTPS /api/planning-sync/outlook endpoint and the same signing secret stored in Key Vault. Do not put the Power Automate URL in this destination. Use Daily events with start and end times and all three planning events. Follow Outbound destinations in the user manual for app configuration.

6. Check authentication, then validate Outlook

Verify that direct unauthenticated calls to the flow are denied. Missing, wrong or body-tampered signatures at Azure must be rejected before any downstream flow run or calendar effect. Missing or unresolved signing configuration must fail closed. Do not relax the trigger allowlist to make a failed identity test pass.

Then use the shared Outlook validation and troubleshooting guide for the calendar lifecycle, repeat-sync and recovery checks. Enable delivery for a working calendar only after the isolated test passes.

Operational ownership

Assign responsibility for Azure hosting, monitoring and signing-secret rotation. Keep secrets, tokens, full callback URLs and request payloads out of logs and screenshots. Coordinate rotation between Key Vault and Planning Sync. HMAC alone does not prevent replay or guarantee ordered concurrent delivery; use the shared guide for uncertain outcomes and safe recovery.

For the simpler setup without an Azure verifier, choose the direct Power Automate recipe. Return to the Recipes index to compare the routes.