Skip to main content
Version: 0.8

Azure Key Vault

TokenTimer uses the Azure Key Vault REST API v7.4 to discover secrets, certificates, and cryptographic keys from your Key Vault instances.

Vault URL format: https://your-vault-name.vault.azure.net

Credential setup​

  1. Azure Portal → Microsoft Entra ID → App registrations → New
  2. Create the app registration (note the Application/Client ID)
  3. Certificates & secrets → New client secret → copy the value
  4. In your Key Vault → Access control → assign the Key Vault Reader role
  5. Get a token: az account get-access-token --resource https://vault.azure.net
  6. Revoke after use. The token is used once and never stored.

Option 2: Azure CLI temporary token​

Run az login, then generate a token with the command above.

Permissions required​

Azure RBAC (recommended):

  • Key Vault Reader role
  • Key Vault Secrets User role (alternative)

Or classic access policies:

  • Get + List for secrets, certificates, and keys

What is discovered​

  • Secrets: name, expiration (attributes.exp), creation/update times
  • Certificates: name, expiration, issuer, creation/update times
  • Cryptographic keys: name, key type, expiration (if set), creation/update times

Metadata only. No secret values, certificate contents, or key materials are retrieved.

info

Azure Key Vault does not support auto-sync on self-hosted TokenTimer. Each scan is a one-time, manual action; credentials are used once and never stored.

  • Microsoft Entra ID to scan app registration secrets and certificates instead of Key Vault contents