Azure Key Vault
We are listening! Please take a few moments to submit your ideas or up-vote already submitted ideas by others. Azure Key Vault team regularly monitors and reviews all feedback submitted on this forum. You will be one of the first to know when a requested feature will be worked on! So be sure to vote or submit your ideas! Remember this site is for feature suggestions and ideas. For technical questions please try documentation, MSDN Forum or StackOverFlow
-
Per-secret/key/certificate access control
Currently it's an all or nothing model. To grant a user account or app id access to one secret, you have to grant it access to the entire vault (as far as I can tell). This eliminates the possibility of least privilege access to secrets. In this model, the only way to create security boundaries for individual secrets is to create additional key vaults, which could get out of control fast if we need one key vault per application per environment. A better model would be to have independent access controls on both the vault and the individual secrets.
For…
402 votesIn public preview.
-
Secret Names do not support special characters
In order for our organization to fully adopt Azure Key Vault for managing passwords and secrets we need to be able to support at a minimum allowing _ (underscrores) and other special characters in the naming convention as we have hundreds of names that contain underscores in them such as accounttest, accountprd, etc..
Reading through the documentation online I can't find any technical reason as to why special characters aren't supported but this is a show stopper at this point for us until this is added/supported.
159 votes -
Add support for PGP keys
Many of our vendors require us to send them files via SFTP using their public encryption keys most of which are PGP keys. As we start to migrate our Managed File Transfer service to Azure we'd like to leverage storing these keys in Azure Key Vault
20 votes -
Add filtering and column sorting options to Keys, Secrets and Certificates
Background:
Is it just me, or is it really annoying that you can't write any filters or sort on columns in the Key Vault resource? We will have like 1500 keys when our projects reaches it's final stage, and the "Show more"-button is really not my best friend.
Suggestion:
Make the lists of Keys, Secrets and Certificates sortable on column name, and add a filter/search field to improve management when browsing the vault using Azure Portal.
To find a Secret in a long list it requires you to scroll down, and press "Load more" which is not convinient at all.
…
13 votes -
Provide the ability to create multiple lines' secret(SSH private key) in azure portal
When I generate a manual type secret, it's impossible to save the multiple lines' secret(SSH private key) value, in fact, I think the input box should take text area as an option.
13 votes -
Restore from another subscription
Limitation - This provided key/secret/certificate backup file was from another subscription. Backups can only be restored into the same subscription.
This is required for customer controlled backup/restore control of TDE keys across subscriptions as there is no alternative way to migrate. This limits HA design for certain resources to be contained within a single subscription.
Allow feature via a flag or whitelist of subscriptions.
12 votes -
Ability to reference a secret without having to specify the secret version explicitly
Hi! Currently the only way to specify a KeyVault reference is to specify the version as well. Could this perhaps be changed to be able to reference a particular version by default (perhaps the newest one). This would really help in the case that a secret needs to be updated and a particular version is no longer valid. Currently I have to go back and change my secret, fetch the new secret version and update all the references accordingly. This gets really tedious when you have a lot of secrets to keep track of.
To make this clear:
Currently my…
11 votes -
Auto Rotate Secrets on connected Resources
Microsoft docs highly recommends the keys/secrets/certificates to be rotated on regular interval for better security posture.
The rotation is only possible by writing powershell code and dont have luxury to write and maintain for every resource.
It would be great to have a feature in Key Vault to do that for us when a resource is connected. Resource could be PaaS SQL, Storage account, Azure Ad APP etc.
KeyVault talks about writing powershell code to recycle keys on storage account.
https://docs.microsoft.com/en-us/azure/key-vault/key-vault-key-rotation-log-monitoring9 votes -
8 votes
-
Full Backup and Restore
Currently, you can only back up each secret one at a time. I would like the ability to back all the secrets up and obviously, store them in an encrypted storage account or vault.
7 votes -
Events when key or secrets are changed or updated in key vault
It’s important to know if keys / Secrets are updated in key vault so that necessary actions with consuming application can be taken when this occurs...
6 votes -
Setting the Secret expiration date in UTC date format instead of in seconds
It would be nice to have the ability to specify the secret expiration date in UTC format instead of in seconds since 1970. I known we can set in the UTC format using powershell but it would be nice to have this option in the ARM template as well.
5 votes -
Portal experience for 'On-Boarding' a Storage Account Key / SAS Rotation
Portal experience for creating a Key Vault Managed Storage Account and/or for 'On-Boarding' a Storage Account into being managed by a given Key Vault Key
This is possible with PowerShell and AzureCLI (as described here: https://docs.microsoft.com/en-us/azure/key-vault/key-vault-ovw-storage-key) but there is not portal experience for doing this.
Originally mentioned in this Github Issue:
https://github.com/MicrosoftDocs/azure-docs/issues/105554 votes -
Support requesting for multiple secret values in the same API call
We request various secret values while initializing our service. The way we do it now is that we issue separate HTTP requests for each using the .NET SDK (GetSecretAsync). Ideally we should be able to request for multiple secrets using the same request.
3 votes -
generate random password api
I want to call an AKV API to generate a random password so that I could use that to update the applications credentials and then call the API to set the current secret value to that new password.
3 votes -
Provide the ability to insert multiple secrets via JSON dictionary or similar method via command line
Today, secrets are able to be added manually and via file, which from my knowledge only accepts one key value pair for the secret. It would be nice to have the ability to insert multiple secrets at once.
3 votes -
Allow secret versions to be deleted
You can create multiple versions for a given secret, however the api only allows a delete to be performed at the secret level and not for an individual version.
3 votes -
manage permissions on an entry level
We are creating a solution where multiple services (backend servers from different departments, ...), will use key vault to retreive their access keys. It would be great to be able to give a backend service access to only the relevant entry (e.g. only to secret1 and certificate2).
The problem is, that a user that has access (to secrets for example), automatically has access to all secrets.In other words: Add access policies to secrets, keys and certificates
3 votes -
Add namespaces to key name
We are planning to use Azure key vault to maintain DB passwords used by microservices. As per standards, in Java Spring, the property name for DB password is "spring.datasource.password". We can store only one value with key corresponding to "spring.datasource.password" in an Azure vault. There might be 100s of microservices and maintaining each microservice with a key vault will be difficult.
Here's the issue from our customer: https://github.com/microsoft/azure-spring-boot/issues/763Hashicorp vault solves this issue with namespaces: https://learn.hashicorp.com/vault/operations/namespaces
2 votes -
Allow write operations to a failed over Key Vault instance
The documentation states that when a regional disaster happens, Azure Key Vault instances are failed over to a paired region as read-only
https://docs.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance
While I understand that regional disasters are very unlikely, the odds of having to modify secrets such as connections strings after a regional disaster can be high.
Being able to update a Key Vault after a disaster would increases the changes of meeting business' RTO.
1 vote
- Don't see your idea?