This article explains how Keepit handles secrets, certificates, and credentials when restoring application registrations and service principals in Entra ID, and what post-restore steps you may need to complete.

Restore limitations

Keepit doesn't support restoring the following:

• Managed identities and agent identities
• Publisher domain (Entra ID limitation)
• Publisher verification status (Entra ID limitation)
• Certification (Entra ID limitation)
• Automated manual admin consent. Because Keepit doesn't use delegated permissions for application restores, admin consent can't be automated.

Secrets and certificates

When Keepit recreates application registration and service principal objects in Entra ID — rather than restoring them from the trash bin — it skips any certificates and secrets unless the connector is connected to an Azure Key Vault instance.

For instructions on connecting a Key Vault instance, see Connect Azure Key Vault.

After a Key Vault-backed restore, Keepit stores recreated password credentials in the Key Vault's secrets and recreated key credentials in the Key Vault's certificates. Each object stored in the Key Vault includes metadata tags to help you identify and filter secrets after the restore.

Note: If a Key Vault instance is connected but can't be reached, or if the permissions on it are too restrictive, any application registrations and service principals that have password or key credentials fail to restore. Other objects selected for the same restore job proceed normally.

Secure handling of secrets

Keepit handles secrets as follows:

• If no Key Vault instance is connected, Keepit doesn't recreate any secrets.
• Keepit doesn't generate cryptographic secrets. It uses Entra ID and Azure Key Vault endpoints to do so, applying the same security parameters in all cases.
• Password credentials are stored briefly in RAM on Keepit servers only and are never written to a snapshot or persisted elsewhere.
• Key credentials' public keys are stored briefly in RAM on Keepit servers only and are never written to a snapshot or persisted elsewhere. Keepit never fetches private keys from the Key Vault.

Security parameters of recreated secrets

Keepit recreates secrets with the following fixed parameters:

These parameters can't be changed. The security parameters of the original secrets aren't used when determining the parameters of the recreated secrets.

Post-restore activities

After a restore, you may need to complete the following manual steps:

• Re-grant admin consent. Recreated applications and service principals may require admin consent to their permission scopes again. This can't be automated without delegated permissions.
• Update credentials in dependent systems. Changes to the application (client) ID and credentials may require updating values in application servers and integration settings.

Key Vault metadata

To help you script post-restore activities, Keepit tags each object it writes to the Key Vault with the following metadata. You can use the Azure Key Vault API to fetch and filter secrets by these tags.

Disconnect Azure Key Vault

To stop using the Key Vault instance, open the connector settings, go to App registration configuration, and deselect Connect Azure Key Vault.

Important: This setting is read at the start of each restore job. Disconnecting the Key Vault doesn't affect restore jobs that are already running.