Skip to content

Create a Microsoft Azure Private Key Vault machine

Create a Microsoft Azure Key Vault machine so Certificate Manager - SaaS can discover the certificates in a key vault and provision certificates to it. Certificate Manager - SaaS connects to the key vault through a VSatellite and signs in as an app registration in your Microsoft Entra tenant.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • An active VSatellite that can reach Microsoft Entra ID and the key vault on port 443.
  • A key vault in the public Azure cloud. Certificate Manager - SaaS connects to the key vault at https://<key-vault-name>.vault.azure.net, so key vaults in other Azure clouds aren't supported.
  • The ID of the Microsoft Entra tenant that the key vault belongs to.
  • An app registration in the tenant that Certificate Manager - SaaS signs in as, and a client secret for it. The app registration needs access to the key vault's certificates and secrets. Discovery lists and reads the certificates and reads the secret behind each certificate to get its chain. Provisioning imports certificates. To create the app registration and grant it access with built-in roles, a custom role, or an access policy, see Configure Azure Key Vault connection.
  • (Optional) To use shared credentials instead of entering the client ID and secret, a connection to CyberArk.

To create a Microsoft Azure Private Key Vault machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Azure Private Key Vault.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

  6. For VSatellite, choose a VSatellite that can reach the machine. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.

  7. In Tenant ID, enter the ID of the Microsoft Entra tenant. Enter it as a universally unique identifier (UUID) in lowercase letters.

  8. For Credential Type, choose how to provide the credentials:

    • Enter Credentials to enter the credentials in the next step. This is the default.
    • Select Credentials to use shared credentials from a credential manager integration. Then, for Credential, choose the credential.

    Note

    Select Credentials requires the credential manager capability, which requires additional licensing. Without it, Credential shows No credentials are available. System Administrators and PKI Administrators can choose any credential. Resource Owners can choose only the credentials that belong to their teams.

  9. If you chose Enter Credentials, in Client ID, enter the application (client) ID of the app registration, and in Client Secret, enter the client secret's value. If you chose Select Credentials, the stored credential must hold the client ID as its username and the client secret as its password.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  10. In Key Vault Name, enter the name of the key vault. Enter only the name, not the full URL. Certificate Manager - SaaS builds the key vault URL from the name, so it doesn't need to list your subscriptions or key vaults.

  11. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Microsoft Entra ID accepts the credentials and that the app registration can list the key vault's certificates. It doesn't confirm that the app registration can read secrets or import certificates.

  12. (Optional) To skip certificates that are disabled in the key vault, enable Exclude Disabled Certificates.

  13. (Optional) To skip certificates that have already expired, enable Exclude Expired Certificates.

    If the app registration can't read a certificate's secret, discovery still finds the certificate, but without its chain.

  14. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  15. Click Continue. The Provisioning step opens.

  16. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  17. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates in your key vault.