PingOne Privilege

Azure Key Vault integration

Connect Azure Key Vault to PingOne Privilege as a secrets hub so that users can use secrets stored in Azure Key Vault.

Setup

Requirements

Configure Azure Key Vault integration

Before you begin

Ensure you have the following:

  • A deployed Azure Key Vault set up with the policies and permissions your organization requires.

  • Azure credentials that PingOne Privilege can use to read the secrets it injects.

Add Azure Key Vault as a secrets hub

  1. In the PingOne Privilege admin console, go to Secrets > Hubs.

  2. On the Secrets Hubs page, click the Add Hubs tab.

  3. In the Azure tile, click Integrate .

  4. Enter a Name and optional Description for the Hub. Click Next.

  5. Follow the instructions in the wizard for creating an App Registration in Azure Active Directory.

  6. Return to the setup wizard, click Next, and enter the required fields from the App Registration creation:

    • Tenant ID

    • Client ID

    • Client Secret

    • Subscription ID

  7. Click Next.

  8. Review the summary, including any filters, and submit the configuration.

  9. Validate the connection:

    1. In the Active Hubs tab, locate the new hub.

    2. Open the hub and verify that its connection status is Synced.

      A new or resynchronizing hub might temporarily display a pending status or a Syncing…​ indicator. If the status is Error, review the hub configuration and Azure permissions.

Use cases

You can use the Azure Key Vault hub for the following use cases.

Rotating secrets

When a session that used an injected secret checks in, PingOne Privilege triggers the configured rotation operation for that secret in Azure Key Vault.

This means:

  • The secret used by the checked-in session is rotated in Azure Key Vault without manual intervention.

  • The next session that requests the secret receives the current value.

Automatic rotation must be configured for the secret in Azure Key Vault, and the credentials used by PingOne Privilege must have the permissions required for the configured rotation operation.

Auditing secret usage

Each use of a secret is recorded as an audit event in the PingOne Privilege audit trail. The event includes the secret name as metadata.

  1. In the PingOne Privilege admin console, go to Activity > Activity Logs.

  2. Use the available filters to locate the session or user activity.

  3. Review the audit event and confirm that it includes the name of the secret that was used.