Strata Copilot
    Next-Gen Trust Security
    : Configure Azure Key Vault connection
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security overview
    5. Welcome to integrations
    6. Cloud Providers Overview
    7. Configure Azure Key Vault connection

    Next-Gen Trust Security

    Configure Azure Key Vault connection

    Table of Contents

    Configure Azure Key Vault connection

    The following guide illustrates connecting Next-Gen Trust Security with Azure Key Vault (AKV).
    Enable Next-Gen Trust Security to provision new certificates in Azure Key Vault (AKV) for use with Azure services. Also, now users have the capability to import existing certificates into keystores. This enables tasks such as rotating, renewing expiring certificates, auto-renewal, changing certificate authorities (CAs), and more.
    This guide walks you through the integration process.

    Before you begin

    You're going to need a few things to complete this procedure.
    • You will need an Azure account.
    • Your Azure Application (client) ID.
    • Your Azure (tenant) ID.
    • Your Azure Client secret.
    • You will need at least one active VSatellite to provision certificates to Azure.
    • Venafi permissions for Azure: You must specify these permissions when defining the role's permission policy.
    Note:
    • Only Next-Gen Trust Security-generated and user-imported certificates with private keys can be provisioned.
    • Only one certificate can be provisioned at a time.

    Overview

    The following diagram illustrates the high-level steps for integrating Next-Gen Trust Security with Azure Key Vault (AKV). In the subsequent sections, we dive into each of these steps, providing you with a guided walkthrough.

    Step 1: Create an Azure App registration (Service Principal)

    1. Log in to the Azure Portal.
    2. In the left panel, select Microsoft Entra ID and then App registrations.
    3. Select the New Registration button in the top left corner.
    4. In the Register an application panel, enter the following values:
      • Name - Enter a name that carries significance and can be readily linked to this specific cloud provider.
      • Supported account types - Choose the appropriate supported account types.
      • Redirect URL - Leave this blank or enter a redirect URI if needed.
    5. Select Register.
      IMPORTANT: You will be presented with your app registration details. Make sure to copy and save the Application (Client) ID and Azure (Tenant) ID for later use.
    6. Select the Add a certificate or secret, and then New client secret. Enter a description and click Add. You will be presented with your Secret ID only once, make sure to copy and save it for later use.

    Step 2: Create Application access in Azure

    In this step we grant permissions on Key Vault resources for the app (Service Principal) you just registered.
    Tip: You will need to add the following permissions to your app to manage Azure Key Vault resources.
    • List subscriptions
    • List key vaults
    • List certificates
    • Import certificate
    • Get certificate
    There are 3 ways to add these permissions:
    1. Add built-in Azure RBAC role(s) to appropriate resources (e.g., a Resource Group or a Key Vault).
      • This option is the quickest, but built-in roles are not as granular.
      • Use this option if ease of implementation is your priority. We select the minimum number of built-in roles to allow access by Next-Gen Trust Security.
    2. Add a custom Azure RBAC role to appropriate resources (e.g., a Resource Group or a Subscription).
      • This option requires extra steps, but custom roles are sufficiently granular only to give minimum required access.
      • Use this option if most granular and minimal access is your priority and you do not mind adding a custom role to Resource Groups or Subscriptions.
    3. Add Azure Access Policy configuration to appropriate Key Vault resources.
      • This option is semi-granular, meaning that the access policy is granular, but a single "reader" built-in Azure RBAC role is also required.
      • Use this option only if you prefer to use Azure Access Policy. This option does not have advantages over a custom RBAC role but has some disadvantages (such as configuring each Key Vault).

    Granting Permissions with Azure Role-Based Access Control (RBAC) Permissions Model

    Using Built-In Role(s)

    Tip: If you are managing your Key Vaults via a Resource Group, then you can add the roles below to said Resource Group, which will be inherited by all contained Key Vaults.
    1. Select applicable Key Vault (or Resource Group if managing Key Vaults via a Resource Group).
    2. Select Access control (IAM).
    3. Select + Add and then Add role assignment.
    4. Select Job function roles unless already selected.
    5. In the search bar enter Key Vault Certificates Officer, this will produce a list, highlight Key Vault Certificates Officer and select Next.
    6. Click + Select members, this will open a panel to your right. Enter the app name you registered in Step 1 and select that app.
    7. Select Review and assign.
    Repeat for each Key Vault (or Resource Group) you wish to configure for access by Next-Gen Trust Security. Your app (registered in Step 1) should have the following role on applicable Key Vaults:
    • Key Vault Certificates Officer

    Using Custom Role

    Create Custom Role
    Note: This role can only be configured on a Resource Group or a Subscription. If you manage your Key Vaults via Resource Groups, you can add this role to appropriate Resource Groups. Otherwise, add this role to appropriate Subscriptions.
    Role names are unique and you'll have to use a different name for each custom role you'll need to create.
    1. Select the applicable Subscription (or Resource Group if managing Key Vaults via a Resource Group) that contains the Key Vaults you wish to give access to.
    2. Select Access control (IAM).
    3. Select + Add and then Add custom role.
    4. Select the JSON tab and then click the Edit button.
    5. Give your role a (unique) name and (optional) description by filling in the appropriate JSON fields (roleName and description).
    6. For the permissions element, replace it with the following:
      "permissions": [
    {
        "actions": [
            "Microsoft.KeyVault/vaults/read",
            "Microsoft.KeyVault/vaults/secrets/read"
        ],
        "notActions": [],
        "dataActions": [
            "Microsoft.KeyVault/vaults/certificates/read",
            "Microsoft.KeyVault/vaults/certificates/update/action",
            "Microsoft.KeyVault/vaults/certificates/create/action",
            "Microsoft.KeyVault/vaults/certificates/import/action"
        ],
        "notDataActions": []
    }
]
    7. Click the Save button.
    8. Select Review + Create, and then select Create.
    You'll have to repeat the above for each Subscription or Resource Group containing Key Vaults you wish to give access to.
    Assign Custom Role
    1. Select the applicable Key Vault (or Resource Group if managing Key Vaults via a Resource Group).
    2. Select Access control (IAM).
    3. Select + Add and then Add role assignment.
    4. Select Job function roles unless already selected.
    5. In the search bar, enter your custom role name. This will produce a list, highlight your custom role, and select Next.
    6. Click + Select members. This will open a panel to your right. Enter the app name you registered in Step 1 and select that app.
    7. Select Review and assign.
    Repeat this for each Key Vault (or Resource Group) you wish to configure for access by Next-Gen Trust Security. Your app (registered in Step 1) should have your custom role on applicable Key Vaults.

    Granting Permissions with Vault Access Policy Permissions Model

    Note: You can still use the RBAC permissions model with these Key Vaults, so if you wish to use the above RBAC configuration, use the instructions in the previous section, and they will apply to these Key Vaults as well.
    First, we need to grant one Azure RBAC permission:
    Tip: If you are managing your Key Vaults via a Resource Group, then you can add the roles below to said Resource Group, which will be inherited by all contained Key Vaults.
    1. Select applicable Key Vault (or Resource Group if managing Key Vaults via a Resource Group).
    2. Select Access control (IAM).
    3. Select + Add and then Add role assignment.
    4. Select Job function roles unless already selected.
    5. In the search bar enter Key Vault Reader, this will produce a list, highlight Key Vault Reader and select Next.
    6. Click + Select members, this will open a panel to your right. Enter the app name you registered in step 1 and select that app.
    7. Select Review and assign.
    Repeat for each Key Vault (or Resource Group) you wish to configure for access by Next-Gen Trust Security. Your app (registered in Step 1) should have the following role on applicable Key Vaults:
    • Key Vault Reader
    Now we can grant access policy permissions:
    These permissions must be granted on each Key Vault you wish to manage. They cannot be granted via a Resource Group.
    1. Select applicable Key Vault.
    2. Select Access policies.
    3. Select + Create.
    4. Under Secret permissions, select Get.
    5. Under Certificate permissions, select Get, List, Update, Create, Import.
    6. Select Next.
    7. For principal, enter the app name you registered in Step 1 and select that app.
    8. Select Next, then select Next again.
    9. Select Create.
    Repeat for each Key Vault you wish to configure for access by Next-Gen Trust Security.

    Step 3: Create a Cloud Provider

    1. Sign in to Next-Gen Trust Security.
    2. Click Configuration > Cloud Providers.
    3. Click New and select Azure.
    4. Enter a Name for the new cloud provider. This name will help Next-Gen Trust Security users to identify this cloud provider.
    5. Click Continue.
    6. Enter your Application (client) ID, Directory (tenant) ID, and Client secret obtained from Azure in the above steps.
      Info:
      • Azure Application (client) ID - is an Active Directory Application Id. The client Id is the unique identifier of an application created in Active Directory. You can have many applications in an Active Directory and each application will have a different access levels.
      • Azure (tenant) ID - is the unique identifier of the Azure Active Directory instance. One subscription can have multiple tenants. Using this Tenant Id you register and manage your apps.
      • Azure Client secret - is a credential that is used to authenticate and authorize a client application when it interacts with Azure services.
    7. Click Save. At this point, your new provider details will be displayed in the right pane.

    Step 4: Validate the connection

    In this step we will validate the connection between Next-Gen Trust Security and Azure.
    1. Click Configuration > Cloud Providers.
    2. Find the new cloud provider we created in Step 1. Click the more options
      button to the right and select Test Access.
      Note: You will notice a yellow icon
      next to your cloud provider that indicates it has yet to be validated. This will go away once you test access and have a successful connection.
    If you still have the yellow icon
    next to your cloud provider, this means you were not able to successfully validate your connection. Go back and check your settings in the above steps.

    Step 5: Add a Cloud Keystore

    1. Sign in to Next-Gen Trust Security.
    2. Click Insights > Cloud Keystores.
    3. Click New and select Azure.
    4. Enter a Name for the new cloud keystore.
    5. Select an Azure Cloud Provider.
    6. Select a Subscription Name.
    7. Select an Azure Key Vault Name.
    8. (Optional) To discover certificates on your keystore, enable Start discovery immediately and Include expired certificates. Once complete, create a schedule.
    9. Click Save. The new cloud keystore appears in the Cloud Keystore list.
    10. (Optional) If discovery was not started during creation, click Discover Now. A status message indicates that discovery is running and results begin to populate in the pane.

    Step 6: Provision a certificate

    At this point you should now have the ability to provision certificates.
    1. Click the More actions (ellipsis) icon next to the cloud keystore you created, and then select Provision.
    Tip: From this menu, you can also delete certificates if needed.
    1. From the dropdown, search for the certificate you want to provision, select it, and then click Provision. This creates a new certificate installation on the cloud keystore.
    2. (Optional) You can also re-provision, replace, or delete an existing certificate.
      • Select your Cloud Keystore to open the details panel.
      • Click the More actions (ellipsis) icon next to the certificate.
      • Select Re-provision, Replace, or Delete, and complete the steps in the user interface.
    Info:
    • Re-provision re-installs the current certificate on the cloud keystore.
    • Replace substitutes the current certificate with a different one.
    • Delete removes the certificate from the cloud keystore.

    Set up AKV Discovery Schedule

    1. In the Next-Gen Trust Security toolbar, click Installations and select Cloud Keystores from the drop-down menu.
    2. Select the Cloud Keystore name that you want to perform a discovery on.
    3. From the pane that opens on the right of the screen, select Discovery configuration. Select the
      toggle switches to turn on "Enable scheduled discovery" and "Include expired certificates".
    4. Under Repeat every, select your desired Daily, Weekly, or Advanced schedule. Then, choose your desired time.
    5. Click Save.

    © 2026 Palo Alto Networks, Inc. All rights reserved.