Prerequisites for Azure Key Vault Secrets Manager

This guide outlines the steps to register an application in Microsoft Entra ID (formerly Azure AD), generate authentication credentials, and grant the minimum required permissions to read secrets from an Azure Key Vault. The collected values map directly to the Azure Key Vault provider fields in the Cloud Exchange Secrets Manager UI.

Click play to watch a video.

Create a Service Principal

Begin by registering an application in the relevant Microsoft Entra ID tenant. This creates the Identity (service principal) that Cloud Exchange will use.

Use the official Microsoft Guide for this step: Register an application with the Microsoft identity platform

Grant Access to Key Vault (Least Privilege)

After the identity exists, grant it permission to read secrets. Use the Key Vault Secrets User role, which allows reading secrets, but not managing them or viewing keys/certificates.

1. Go to the target Key Vault resource in the Azure portal.
2. In the left menu, select Access control (IAM).
3. Click + Add and select Add role assignment.
4. Select a Role:
   • Search for and select: Key Vault Secrets User
   • Permissions included: Get and List secrets.
   • Click Next.
5. Select Members:
   • Ensure Assign access to is set to User, group, or service principal.
   • Click + Select members.
   • Search for the name of the application created in Part 1.
   • Select the principal from the list and click Select.
6. Click Review + assign to finish.

Configure Authentication Credentials

Choose one of the following options to authenticate the application. These values populate the Authentication Method, Client Secret, and/or Certificate Path fields in the Secrets Manager UI.

Option A: Client Secret (Password-based)

1. Go to App registrations in the Azure portal and select the newly created application.
2. In the left menu, select Certificates & secrets.
3. Click on the Client secrets tab.
4. Click + New client secret.
5. Add a description (like Netskope CE Secret) and choose an expiration period.
6. Click Add.
7. Copy the Value of the client secret immediately; it cannot be viewed again after leaving the page.
8. In Cloud Exchange, paste this value into the Client Secret field.

Option B: Client Certificate (Certificate-based)

Before proceeding, ensure the public key file of the X.509 certificate is available.

1. Go to App registrations in the Azure portal and select the application.
2. In the left menu, select Certificates & secrets.
3. Click on the Certificates tab.
4. Click Upload certificate.
5. Select the .crt, .cer, or .pem file.
6. Click Add.
7. In Cloud Exchange, paste the same file in the Certificate field and provide the passphrase if the certificate is encrypted.

Summary of Required Configuration Params

When completed, the following parameters are required to configure the product: