6.5.6 Azure Key Vault

The Azure Key Vault template signs in with a Microsoft Entra service principal and imports the deployed PFX as a Key Vault certificate.

Requirements

• Install the Az PowerShell modules on the Windows agent host. The template uses Connect-AzAccount and Import-AzKeyVaultCertificate.
• Create a service principal with a client secret.
• Supply the tenant ID, subscription ID, service-principal application ID and secret, vault name, and certificate name.
• Ensure the agent can reach Azure sign-in and Key Vault endpoints over HTTPS.

Grant certificate import permission

Use the permission model configured on the target vault:

• Azure role-based access control: assign Key Vault Certificates Officer on the vault to the service principal.
• Legacy access policies: grant the service principal the certificate Import and Create permissions.

Scope the permission to the target vault where possible.

Certificate name and versions

Keep the Certificate name stable. Importing another certificate with the same name creates a new Key Vault version, allowing services that reference that certificate name to use the renewal.

If the name was deleted but remains soft-deleted, Azure rejects a new import with that name. Recover the deleted certificate or purge it before retrying.

Authentication failures

For a failed Connect-AzAccount, verify the tenant, subscription, application ID, secret value, and secret expiration. For an authorization failure during import, confirm the permission was assigned to the service principal—not the interactive administrator—and allow time for a new role assignment to propagate.

For a product overview, see certificate automation for Azure Key Vault.