Azure Key Vault

We are listening! Please take a few moments to submit your ideas or up-vote already submitted ideas by others. Azure Key Vault team regularly monitors and reviews all feedback submitted on this forum. You will be one of the first to know when a requested feature will be worked on! So be sure to vote or submit your ideas! Remember this site is for feature suggestions and ideas. For technical questions please try documentation, MSDN Forum or StackOverFlow

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Per-secret/key/certificate access control

    Currently it's an all or nothing model. To grant a user account or app id access to one secret, you have to grant it access to the entire vault (as far as I can tell). This eliminates the possibility of least privilege access to secrets. In this model, the only way to create security boundaries for individual secrets is to create additional key vaults, which could get out of control fast if we need one key vault per application per environment. A better model would be to have independent access controls on both the vault and the individual secrets.

    For…

    261 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    started  ·  29 comments  ·  Managing application secrets  ·  Flag idea as inappropriate…  ·  Admin →
  2. Notify Users when secrets/keys are expiring

    Currently certificates management supports email notification when certificates are expiring. Wouldn't it be great to have the same functionality for keys and secrets?

    158 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    29 comments  ·  Other  ·  Flag idea as inappropriate…  ·  Admin →
  3. Key Vault - Allow using AD Groups (RBAC) on Keys and Secret level

    I am an infrastructure admin, and i would like to use a single keyvault where i can maintain secrets and keys and use RBAC to allow users, Groups, Service Principals to insure they only have access to what they need. this would simplify my administration of this service, perhaps adding folders/group tags to secrets within the keyvault and setting permissions based on those would also be an option

    59 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    started  ·  6 comments  ·  Flag idea as inappropriate…  ·  Admin →
  4. Semicolon bug in Microsoft.Azure.Services.AppAuthentication

    Hi

    I have found a bug in Microsoft.Azure.Services.AppAuthentication package.

    When a {ClientSecret} is generated with a semicolon eg. )}/}I;:}=&GG8U{Zt;4+[Jd{
    you can reproduce the bug.

    I wanted to use AzureServiceTokenProvider to obtain token for keyvault as mentioned in article --

    https://docs.microsoft.com/en-us/azure/key-vault/service-to-service-authentication#running-the-application-using-managed-identity

    Running the application using a Service Principal

    To sign in using an Azure AD shared secret credential:

    RunAs=App;AppId={AppId};TenantId={TenantId};AppKey={ClientSecret}

    When the {ClientSecret} is generated without any semicolon, this approach works well.

    Request you to please fix the issue.

    Regards
    Sekhar Shrivastava

    1 vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    2 comments  ·  Other  ·  Flag idea as inappropriate…  ·  Admin →

    This is fixed in the preview in the following preview…please try it out and let us know if you have any feedback

    nuget.org/packages/Microsoft.Azure.Services..
    Release Notes
    Documentation can be found at go.microsoft.com/fwlink/p/?linkid=862452.

    Improvements for local development token request times
    Support for CancellationTokens
    Support for specifying user-assigned identity in SQL connection string with SqlAppAuthenticationProvider
    Adding retry logic for MsiAccessTokenProvider
    Removing TenantId as required connection string parameter when using KeyVaultCertificateSecretIdentifier parameter
    Adding quote escaping for connection string parameter values
    Other minor fixes and test updates

  • Don't see your idea?

Feedback and Knowledge Base