Azure Client Secrets Connection

Learn how to configure an Azure Client Secrets Connection for Infisical.

Infisical currently only supports two methods for connecting to Azure, which are OAuth and Client Secrets.

Self-Hosted Instance

Using the Azure Client Secrets connection on a self-hosted instance of Infisical requires configuring an application in Azure and registering your instance with it.

Prerequisites:

• Set up Azure.

1. Create an application in Azure

   Navigate to Azure Active Directory > App registrations to create a new application.

   Azure Active Directory is now Microsoft Entra ID.

   

   Create the application. As part of the form, set the Redirect URI to https://your-domain.com/organization/app-connections/azure/oauth/callback.

   The domain you defined in the Redirect URI should be equivalent to the SITE_URL configured in your Infisical instance.

   
2. Assign API permissions to the application

   For the Azure Connection to work with Client Secrets, you need to assign the following permission to the application.

   Azure Client Secrets permissions

   Set the API permissions of the Azure application to include the following permissions:

   • Microsoft Graph

     • Application.ReadWrite.All

     • Application.ReadWrite.OwnedBy

     • Application.ReadWrite.All (Delegated)

     • Directory.ReadWrite.All (Delegated)

     • User.Read (Delegated)

       
3. Add your application credentials to Infisical

   Obtain the Application (Client) ID and Directory (Tenant) ID (this will be used later in the Infisical connection) in Overview and generate a Client Secret in Certificate & secrets for your Azure application.

   

   Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.

   • INF_APP_CONNECTION_AZURE_CLIENT_SECRETS_CLIENT_ID: The Application (Client) ID of your Azure application.
   • INF_APP_CONNECTION_AZURE_CLIENT_SECRETS_CLIENT_SECRET: The Client Secret of your Azure application.

   Once added, restart your Infisical instance and use the Azure Client Secrets connection.

Client Secret Authentication

Ensure your Azure application has the required permissions that Infisical needs for the Azure Client Secrets connection to work.

Prerequisites:

• An active Azure setup.

1. Assign API permissions to the application

   For the Azure Client Secrets connection to work, assign the following permissions to your Azure application:

   Required API Permissions

   Microsoft Graph

   • Application.ReadWrite.All

   • Application.ReadWrite.OwnedBy

   • Application.ReadWrite.All (Delegated)

   • Directory.ReadWrite.All (Delegated)

   • User.Read (Delegated)

     

Certificate Authentication

Ensure your Azure application has the required permissions that Infisical needs for the Azure Client Secrets connection to work.

Prerequisites:

• An active Azure setup.

1. Assign API permissions to the application

   For the Azure Client Secrets connection to work, assign the following permissions to your Azure application:

   Required API Permissions

   Microsoft Graph

   • Application.ReadWrite.All

   • Application.ReadWrite.OwnedBy

   • Application.ReadWrite.All (Delegated)

   • Directory.ReadWrite.All (Delegated)

   • User.Read (Delegated)

     
2. Upload your certificate to your Azure App Registration

   Navigate to the Certificates & secrets section of your Azure App Registration, and press the Upload certificate button.

   Select the Upload button and upload your certificate.

   

   Keep in mind that both the certificate and its private key are required to configure the Azure Client Secrets connection in Infisical.

Setup Azure Connection in Infisical

1. Navigate to App Connections

   Navigate to the App Connections page in the desired project.

2. Add Connection

   Select the Azure Connection option from the connection options modal.

3. Create Connection

   OAuth
4. Connection Created

   Your Azure Client Secrets Connection is now available for use.