Skip to main content

Azure Key Vault

TokenTimer uses the Azure Key Vault REST API v7.4 to discover secrets, certificates, and cryptographic keys from your Key Vault instances.

Vault URL format: https://your-vault-name.vault.azure.net

Commercial Azure only. Token minting uses https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token with scope https://vault.azure.net/.default. National clouds (China, US Government, and similar) are not supported.

Authenticate with an Entra app via client credentials (authMethod: client_credentials plus tenant ID, client ID, and client secret; recommended) or a pasted access token. Credentials are used for the scan only and are never stored for TokenTimer Cloud manual import. TokenTimer Cloud has no scheduled auto-sync for Azure Key Vault (or any provider).

Credential setup​

TokenTimer mints an access token from https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token using the OAuth 2.0 client-credentials grant. Scope: https://vault.azure.net/.default.

  1. Azure Portal → Microsoft Entra ID → App registrations → New registration
  2. Note the Directory (tenant) ID and Application (client) ID
  3. Certificates & secrets → New client secret → copy the value
  4. In your Key Vault → Access control (IAM) → assign Key Vault Reader to the app's service principal
  5. In TokenTimer, choose Client credentials (authMethod: client_credentials) and enter Tenant ID, Client ID, and Client secret
  6. Credentials are used for the scan only and never stored

Inventory lists secret, certificate, and key metadata. It does not fetch secret values.

Key Vault client-credential mint uses the tenant GUID or domain as supplied. It does not call OpenID discovery (unlike Entra ID inventory).

This identity is for inventory import, not CertOps Azure DNS. DNS-01 uses a separate Entra app with DNS Zone Contributor; see Azure DNS. Do not reuse that app for inventory unless you intentionally want both roles on one identity.

Option B: Pasted access token (Azure CLI)​

  1. az login
  2. az account get-access-token --resource https://vault.azure.net
  3. In TokenTimer, choose Token auth and paste the accessToken value. Tenant ID is not required on this path.
  4. Revoke or discard after use. The token expires quickly; it is used once and never stored. No OpenID discovery runs for pasted tokens.

Permissions required​

Azure RBAC (recommended):

  • Key Vault Reader on the vault (least privilege for this inventory)

Or classic access policies:

  • Secrets and keys: List may suffice for inventory metadata
  • Certificates: List plus Get when you want subject/issuer enrichment from the public certificate (cer)

What is discovered​

  • Secrets: name, expiration (attributes.exp), creation/update times
  • Certificates: name, expiration, issuer, creation/update times
  • Cryptographic keys: name, key type, expiration (if set), creation/update times

No secret values or private keys. Public certificate material (cer) may be read to enrich subject/issuer.

Scan options​

  • Filter rules: optional include/exclude rules (exact or regex, on name or description) applied via the scan API. See Filter rules.
  • Remove obsolete items: opt-in cleanup that deletes previously imported tokens no longer found at the source. See Obsolete-token cleanup.