Skip to main content
Version: 0.15

Azure Key Vault

TokenTimer uses the Azure Key Vault REST API v7.4 to discover secrets, certificates, and cryptographic keys from your Key Vault instances.

Vault URL format: https://your-vault-name.vault.azure.net

Commercial Azure only. Token minting uses https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token with scope https://vault.azure.net/.default. National clouds (China, US Government, and similar) are not supported. AZURE_VAULT_ADDRESS_ALLOWLIST cannot make those endpoints work.

Authenticate with an Entra app via client credentials (authMethod: client_credentials plus tenant ID, client ID, and client secret; recommended) or a pasted access token. Client credentials work for manual scans on Core and Enterprise. Where Enterprise auto-sync is entitled, client-credential or token configs can be stored for scheduled scans. Core scheduled auto-sync stays GitHub and GitLab; Azure Key Vault auto-sync is not a Core capability.

Credential setup​

TokenTimer mints an access token from https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token using the OAuth 2.0 client-credentials grant. Scope: https://vault.azure.net/.default.

  1. Azure Portal → Microsoft Entra ID → App registrations → New registration
  2. Note the Directory (tenant) ID and Application (client) ID
  3. Certificates & secrets → New client secret → copy the value
  4. In your Key Vault → Access control (IAM) → assign Key Vault Reader to the app's service principal
  5. In TokenTimer, choose Client credentials (authMethod: client_credentials) and enter Tenant ID, Client ID, and Client secret
  6. On Core, credentials are used for the manual scan only and never stored. On Enterprise, they may be stored for auto-sync where entitled.

Inventory lists secret, certificate, and key metadata. It does not fetch secret values.

Option B: Pasted access token (Azure CLI)​

  1. az login
  2. az account get-access-token --resource https://vault.azure.net
  3. In TokenTimer, choose Token auth and paste the accessToken value
  4. On Core, use immediately and discard: the token expires quickly and is never stored. On Enterprise auto-sync, prefer Option A so TokenTimer can mint fresh tokens.

Permissions required​

Azure RBAC (recommended):

  • Key Vault Reader on the vault (least privilege for this inventory)

Or classic access policies:

  • Secrets and keys: List may suffice for inventory metadata
  • Certificates: List plus Get when you want subject/issuer enrichment from the public certificate (cer)

What is discovered​

  • Secrets: name, expiration (attributes.exp), creation/update times
  • Certificates: name, expiration, issuer, creation/update times
  • Cryptographic keys: name, key type, expiration (if set), creation/update times

No secret values or private keys. Public certificate material (cer) may be read to enrich subject/issuer.

Scan options​

  • Filter rules: optional include/exclude rules (exact or regex, on name or description) applied via the scan API. See Filter rules.
  • Remove obsolete items: opt-in cleanup that deletes previously imported tokens no longer found at the source. See Obsolete-token cleanup.
info

Azure Key Vault does not support auto-sync on self-hosted TokenTimer Core. Each scan is a one-time, manual action; credentials are used once and never stored. TokenTimer Enterprise adds scheduled auto-sync for this provider under a per-provider license entitlement, including client-credentials auth; see Enterprise auto-sync.