> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure client secrets connection

> Learn how to configure an Azure Client Secrets Connection for Infisical.

Infisical currently only supports two methods for connecting to Azure, which are OAuth and Client Secrets.

> [accordion] Self-Hosted Instance
>
> Using the Azure Client Secrets connection on a self-hosted instance of Infisical requires configuring an application in Azure
> and registering your instance with it.
>
> **Prerequisites:**
>
> * Set up Azure.
>
> **1. Create an application in Azure**
>
> Navigate to Entra ID > App registrations to create a new application.
>
> > [!NOTE]
> >
> > Azure Active Directory is now Microsoft Entra ID.
>
> ![Azure client secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-aad.png)
>
> ![Azure client secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-new-app.png)
>
> Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/organization/app-connections/azure/oauth/callback`.
>
> > [!TIP]
> >
> > The domain you defined in the Redirect URI should be equivalent to the `SITE_URL` configured in your Infisical instance.
>
> ![Azure client secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/register-callback.png)
>
> **2. Assign API permissions to the application**
>
> For the Azure Connection to work with Client Secrets, you need to assign the following permission to the application.
>
> #### Azure client secrets permissions
>
> Set the API permissions of the Azure application to include the following permissions:
>
> * Microsoft Graph
>   * `Application.ReadWrite.All`
>   * `Application.ReadWrite.OwnedBy`
>   * `Application.ReadWrite.All` (Delegated)
>   * `Directory.ReadWrite.All` (Delegated)
>   * `User.Read` (Delegated)
>
>     ![Azure client secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-client-secrets/app-api-permissions.png)
>
> **3. Add your application credentials to Infisical**
>
> Obtain the **Application (Client) ID** and **Directory (Tenant) ID** (this will be used later in the Infisical connection) in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.
>
> ![Azure client secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/config-credentials-1.png)
>
> ![Azure client secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-credentials-2.png)
>
> ![Azure client secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-credentials-3.png)
>
> Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.
>
> * `INF_APP_CONNECTION_AZURE_CLIENT_SECRETS_CLIENT_ID`: The **Application (Client) ID** of your Azure application.
> * `INF_APP_CONNECTION_AZURE_CLIENT_SECRETS_CLIENT_SECRET`: The **Client Secret** of your Azure application.
>
> Once added, restart your Infisical instance and use the Azure Client Secrets connection.

> [accordion] Client Secret Authentication
>
> Ensure your Azure application has the required permissions that Infisical needs for the Azure Client Secrets connection to work.
>
> **Prerequisites:**
>
> * An active Azure setup.
>
> **1. Assign API permissions to the application**
>
> For the Azure Client Secrets connection to work, assign the following permissions to your Azure application:
>
> #### Required API permissions
>
> **Microsoft Graph**
>
> * `Application.ReadWrite.All`
>
> * `Application.ReadWrite.OwnedBy`
>
> * `Application.ReadWrite.All` (Delegated)
>
> * `Directory.ReadWrite.All` (Delegated)
>
> * `User.Read` (Delegated)
>
>   ![Azure client secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-client-secrets/app-api-permissions.png)
>
> > [!NOTE]
> >
> > If you want to configure automatic client secret rotation for this App Connection, you also need to grant either `Application.ReadWrite.OwnedBy` or `Application.ReadWrite.All` permissions.

> [accordion] Certificate Authentication
>
> Ensure your Azure application has the required permissions that Infisical needs for the Azure Client Secrets connection to work.
>
> **Prerequisites:**
>
> * An active Azure setup.
>
> **1. Assign API permissions to the application**
>
> For the Azure Client Secrets connection to work, assign the following permissions to your Azure application:
>
> #### Required API permissions
>
> **Microsoft Graph**
>
> * `Application.ReadWrite.All`
> * `Application.ReadWrite.OwnedBy`
> * `Application.ReadWrite.All` (Delegated)
> * `Directory.ReadWrite.All` (Delegated)
> * `User.Read` (Delegated)
>
>   ![Azure client secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-client-secrets/app-api-permissions.png)
>
> **2. Upload your certificate to your Azure App Registration**
>
> Navigate to the **Certificates & secrets** section of your Azure App Registration, and press the **Upload certificate** button.
>
> Select the **Upload** button and upload your certificate.
>
> ![Upload certificate](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/upload-certificate.png)
>
> > [!TIP]
> >
> > Keep in mind that both the certificate and its private key are required to configure the Azure Client Secrets connection in Infisical.

## Setup Azure connection in Infisical

**1. Navigate to App Connections**

Navigate to the **Integrations** tab in the desired project, then select **App Connections**. ![App Connections
Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)

**2. Add Connection**

Select the **Azure Connection** option from the connection options modal. ![Select Azure Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/select-connection.png)

**3. Create Connection**

> [tab] OAuth
>
> **1. Authorize Connection**
>
> Fill in the **Tenant ID** field with the Directory (Tenant) ID you obtained in the previous step.
>
> Now select the **OAuth** method and click **Connect to Azure**.
>
> ![Connect via Azure OAuth](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/create-oauth-method.png)
>
> > [!NOTE]
> >
> > If you use Infisical Cloud, the OAuth flow requests every permission on Infisical's shared Azure app registration (the `.default` scope), including the permissions for Azure App Configuration. If your Azure tenant doesn't have the Azure App Configuration service principal, the OAuth flow fails. To create the service principal, run the following [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) command, then try to connect again:
> >
> > ```bash theme={"dark"}
> > az ad sp create --id 35ffadb3-7fc1-497e-b61b-381d28e744cc
> > ```
> >
> > `35ffadb3-7fc1-497e-b61b-381d28e744cc` is the application ID that Microsoft assigns to Azure App Configuration, and it's the same in every Azure tenant.
>
> **1. Grant Access**
>
> You will then be redirected to Azure to grant Infisical access to your Azure account. Once granted,
> you will be redirected back to Infisical's App Connections page. ![Azure Client Secrets
> Authorization](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/grant-access.png)

> [tab] Client Secret
>
> **1. Create Connection**
>
> Fill in the **Tenant ID**, **Client ID** and **Client Secret** fields with the Directory (Tenant) ID, Application (Client) ID and Client Secret you obtained in the previous step.
>
> ![Connect via Azure OAuth](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/create-client-secrets-method.png)
>
> > [!TIP]
> >
> > You can optionally enable **Automatic Credential Rotation** for this connection. See the [Automatic Credential Rotation](#automatic-credential-rotation) section below for details.

> [tab] Certificate
>
> **1. Create Connection**
>
> Fill in the **Tenant ID**, **Client ID**, **Certificate (PEM format)**, and **Private Key** fields with the Directory (Tenant) ID, Application (Client) ID, Certificate and Private Key you obtained in the [previous step](#certificate-authentication).
>
> > [!TIP]
> >
> > The private key is never transmitted to Azure, and it is only used to sign the client assertion used to authenticate with Azure.
>
> ![Connect via Azure Certificate](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/create-certificate-method.png)

**4. Connection Created**

Your **Azure Client Secrets Connection** is now available for use. ![Azure Client Secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/oauth-connection.png)

## Automatic credential rotation

When using the **Client Secret** authentication method, Infisical can automatically rotate the Client Secret of your Azure application on a recurring schedule. When enabled, Infisical will immediately generate a new Client Secret on connection creation and revoke the original one, ensuring that no external party retains access using the credentials you provided.

> [!NOTE]
>
> Automatic Credential Rotation is only available for the **Client Secret** authentication method.

**1. Locate the Key ID of your Client Secret**

Before enabling rotation, you'll need the **Key ID** of the Client Secret you're using to authenticate. Navigate to your App Registration in the Azure Portal, then go to **Certificates & secrets**. Copy the **Secret ID** (Key ID) of the secret you're providing to Infisical.

![Azure Client Secret Key ID](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/credential-rotation-key-id.png)

**2. Enable Automatic Credential Rotation**

When creating or editing your connection, toggle on the **Automatic Credential Rotation** switch.

![Enable Automatic Credential Rotation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/credential-rotation-toggle.png)

**3. Provide the Client Secret Key ID**

Enter the **Key ID** you copied in the previous step into the **Client Secret Key ID** field. Infisical uses this to revoke your original secret after generating a new one.

![Client Secret Key ID Field](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/credential-rotation-key-id-field.png)

**4. Configure the Rotation Schedule**

Set the **Rotation Interval** (in days) to define how often the credential should be rotated, and set **Rotate At** to the local time of day at which the rotation should occur.

* **Rotation Interval** – How many days between each rotation.
* **Rotate At** – The local time of day at which the rotation will be triggered.

  ![Rotation Schedule](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/credential-rotation-schedule.png)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.