Correlate findings with Azure Key Vault

When HCP Vault Radar connects to Azure Key Vault, Vault Radar can correlate findings with secrets stored in Azure Key Vault. This allows you to identify what secrets you need to rotate.

Connect Azure Key Vault

Before you can correlate findings with Azure Key Vault, you need to deploy the Radar agent. Once you deploy the agent, you can configure and connect Azure Key Vault to the agent.

Prerequisites

You need one of the following Azure authentication methods:

Managed Identity: The Azure VM running the Radar agent has a system-assigned managed identity. No credentials need to be stored or rotated. This method only works when the agent runs inside Azure.
Azure Credentials (Service Principal): An explicit Tenant ID, Client ID, and Client Secret from an Azure App Registration (service principal). Use this method when running the agent outside of Azure or when a managed identity is not available.

Both authentication methods require the agent identity to have Azure RBAC permissions on the target subscription and its Key Vaults.

Required Azure RBAC permissions

The managed identity or service principal used by the Radar agent must have the following role assignments:

Scope	Role	Purpose
Subscription	`Reader`	List all Key Vault instances in the subscription via Azure Resource Manager
Subscription	`Key Vault Secrets User`	Read secret values from the Key Vault data plane

Vault Radar uses two separate Azure API surfaces:

Azure Resource Manager (management.azure.com) — discovers all Key Vault instances in the subscription. Requires the Reader role at the subscription scope.
Key Vault data plane ({vaultname}.vault.azure.net) — reads each secret value. Requires the Key Vault Secrets User role at the subscription scope.

Note

Azure Key Vaults must be configured with the Azure role-based access control permission model (not the legacy Vault access policies model) for the Key Vault Secrets User role assignment to take effect.

Agent configuration with Azure Key Vault

Set up and manage Azure Key Vault from the Vault Radar module in the HCP Portal.

Click Settings.
Click Secret Managers.
Click Connect new secret manager.
Select Azure Key Vault and click Next.
Select an Azure authentication method from the Authentication method pulldown menu.
Enter the details for the selected method and click Next to validate the connection.
- Select Managed Identity if the Radar agent runs on an Azure VM with a system-assigned managed identity enabled. The VM's identity is used automatically — no credentials are required.
- Enter the Azure Subscription ID that contains the Key Vaults you want to scan.
- Select Azure Credentials if you want to use an explicit service principal. You will need an App Registration with a client secret created in Microsoft Entra ID.
- Enter your Tenant ID in the Tenant ID text field.
- Enter your Client ID location in the Client ID Env variable text field (default: env://AZURE_CLIENT_ID).
- Enter your Client Secret location in the Client Secret Env variable text field (default: env://AZURE_CLIENT_SECRET).
- Enter the Azure Subscription ID that contains the Key Vaults you want to scan.

Vault Radar discovers all Key Vault instances in the subscription and automatically starts an index scan for each vault.

How Azure Key Vault indexing works

Vault Radar performs an index scan against Azure Key Vault. Secrets stored in a managed secret store are expected to be there, so Vault Radar builds an index of secret fingerprints (hashed values) and correlates them against findings from code and content scans.

When a hashed value found in a code scan matches a hashed value in the Azure Key Vault index, Vault Radar marks the finding as managed and raises the severity. This tells you that a secret leaked in code is also stored in Azure Key Vault and needs to be rotated.

Vault Radar scans all enabled secret versions in each Key Vault. You can optionally include historic (previous) secret versions in the index scan for broader coverage of rotated secrets.