Connect Azure Key Vault

This article explains how to connect an Azure Key Vault instance to a Keepit connector so that application and service principal restores can store newly created certificates and secrets in your own vault.

Prerequisites

• You have: a Master Admin or Backup Admin role in Keepit.
• Your Azure account: has permission to create and configure Key Vault instances in the Azure portal.
• Your connector: is configured for Keepit for Entra ID.

Step 1: Create a Key Vault instance in Azure

Create a Key Vault instance in the Azure portal.

Note: The Key Vault instance must be placed in the same tenant as the Keepit for Entra ID service principal you use for restores. Enable public network access so that Keepit can connect to the vault using its unique identifier.

Step 2: Assign permissions

Assign permissions to the Keepit for Entra ID service principal you use for restores. The method depends on the permission model configured on your Key Vault.

If you use Azure role-based access control (RBAC)

Add a role assignment with the following roles:

• Key Vault Secrets Officer — performs any action on the secrets of a key vault, except manage permissions. Applies only to key vaults that use the Azure role-based access control permission model.
• Key Vault Certificates Officer — performs any action on the certificates of a key vault, except manage permissions. Applies only to key vaults that use the Azure role-based access control permission model.

As the member of the assignment, select the Keepit for Entra ID service principal you use for restores.

If you use vault access policies

Create an access policy with the following permissions:

• Secret permissions: Set.
• Certificate permissions: Get, Update, and Create.

As the principal, select the Keepit for Entra ID service principal you use for restores.

Step 3: Enable Key Vault-backed restores

1. In the Azure portal, open your Key Vault instance and copy the Vault URI from the overview pane. The URI has the format https://your-vault-name.vault.azure.net.

2. In Keepit, go to your connector configuration and select the gear icon next to App registrations.

3. Select Connect Azure Key Vault.

4. Enter the Vault URI you copied in step 1.

5. Select Save.

All application and service principal restores on this connector now use the connected Key Vault instance to store newly created certificates and secrets.

Note: This setting applies to restore jobs only. It has no effect on backup jobs.

Disconnect Azure Key Vault

To stop using the Key Vault instance, open the connector configuration, select the gear icon next to Applications, and deselect Connect Azure Key Vault.

Warning: This setting is read at the start of each restore job. Disconnecting the Key Vault doesn't affect restore jobs that are already running.