Skip to main content

Azure Key Vault

TokenTimer uses the Azure Key Vault REST API v7.4 to discover secrets, certificates, and cryptographic keys from your Key Vault instances.

Vault URL format: https://your-vault-name.vault.azure.net

Credential setup​

  1. Azure Portal → Microsoft Entra ID → App registrations → New
  2. Create the app registration (note the Application/Client ID)
  3. Certificates & secrets → New client secret → copy the value
  4. In your Key Vault → Access control → assign the Key Vault Reader role
  5. Get a token: az account get-access-token --resource https://vault.azure.net
  6. Revoke after use. The token is used once and never stored.

Option 2: Azure CLI temporary token​

Run az login, then generate a token with the command above.

Permissions required​

Azure RBAC (recommended):

  • Key Vault Reader role
  • Key Vault Secrets User role (alternative)

Or classic access policies:

  • Get + List for secrets, certificates, and keys

What is discovered​

  • Secrets: name, expiration (attributes.exp), creation/update times
  • Certificates: name, expiration, issuer, creation/update times
  • Cryptographic keys: name, key type, expiration (if set), creation/update times

Metadata only. No secret values, certificate contents, or key materials are retrieved.

  • Microsoft Entra ID to scan app registration secrets and certificates instead of Key Vault contents