# Connect Azure Key Vault
> Part of the NocoDB documentation (Product docs > Integrations > Vaults ☁). Index of all pages: https://nocodb.com/llms.txt. Any docs page is available as Markdown by adding `.md` to its URL.
URL: https://nocodb.com/docs/product/integrations/vaults/azure-key-vault
Last updated: 2026-11-11
Connect Azure Key Vault to NocoDB as an Enterprise vault: register an Entra ID application, give it read access to the Key Vault, then reference secrets from your integrations.
NocoDB reads secrets from one Azure Key Vault. It signs in to Microsoft Entra ID as an **application** (an app registration with a client secret) and reads the secrets that application is allowed to read.
## Before you begin
* The **Enterprise Vaults** add-on, on the NocoDB **Enterprise** plan or a **Self-hosted Enterprise** license. No plan includes it. See [Turning on Enterprise Vaults](/docs/product/integrations/vaults#turning-on-enterprise-vaults).
* **Workspace Owner** for a workspace vault, or **Org Admin** for an organization vault. See [Permissions](/docs/product/integrations/vaults#permissions).
* In Azure, permission to create app registrations in Entra ID and to assign roles on the Key Vault.
## 1. Register an application
In the Azure portal, open **Microsoft Entra ID → App registrations → New registration**. Name it `nocodb-vault-reader`, leave the redirect URI empty and register it.
From the app's **Overview** page copy:
| | |
| ----------------------- | ---------------------------- |
| Application (client) ID | identifies the app |
| Directory (tenant) ID | identifies your Entra tenant |
Then open **Certificates & secrets → Client secrets → New client secret**, pick an expiry, and copy the secret's **Value** right away. Azure shows it once.
Copy the secret **Value**, not its **Secret ID**. The two columns sit next to each other and the ID is what people paste by mistake. NocoDB reports it as "Entra ID rejected the client secret".
## 2. Let the application read the vault
Open the Key Vault, then **Access control (IAM) → Add → Add role assignment**. Choose the role **Key Vault Secrets User**, and assign it to the `nocodb-vault-reader` application.
The Key Vault Secrets User role allows reading secret values and nothing else. If the vault still uses the older **Access policies** model, add a policy for the application with the **Get** secret permission instead.
If the vault has a **firewall**, NocoDB must be allowed through it. NocoDB connects to the vault's public DNS name only, so a vault reachable only through a private endpoint cannot be used.
## 3. Store a secret
Open **Objects → Secrets → Generate/Import**, name the secret `db-password` and set its value.
A Key Vault secret holds one value, so a reference names the secret and nothing more. To back both a username and a password, store two secrets.
## 4. Connect the vault in NocoDB
Click **Connect a vault** on the banner at the top of the workspace **Integrations** page, or open **Vaults** in the Admin Panel for an organization-scoped vault. Choose **Azure Key Vault**, click **Next**, and fill in:
| Field | Value |
| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Reference name | a short alias such as `azProd`. See [Choosing the reference name](/docs/product/integrations/vaults#choosing-the-reference-name) |
| Vault URL | the **Vault URI** from the vault's Overview page, for example `https://my-vault.vault.azure.net` |
| Directory (tenant) ID, Application (client) ID | from step 1 |
| Client secret | the secret **Value** from step 1 |
| Who can use this vault | **Workspace owners** for a workspace vault, **Org owners and admins** for an organization vault. See [Who can use a vault](/docs/product/integrations/vaults#who-can-use-a-vault) |
The vault URL must be `https://` and end in `.vault.azure.net`. Azure China (`.vault.azure.cn`) and Azure Government (`.vault.usgovcloudapi.net`) vaults are accepted too; NocoDB signs in at the matching Entra authority. A private-link host name (`privatelink.vaultcore.azure.net`) and Managed HSM are not supported, and any path after the host name is dropped.
Click **Next** and run the test on the **Verify** step. NocoDB signs in to Entra ID with the client secret and contacts the vault. The test passes when the application is authenticated, even if a role assignment is still propagating. It fails on a wrong credential, a wrong URL or a firewall block. Then save.
## Reference a secret
Reference an Azure Key Vault secret from a credential field as:
```
secrets.azProd["db-password"]
```
No field follows the secret name. NocoDB reads the secret's latest version. If that version is disabled, the read fails with "This secret version is disabled in Key Vault" until it is enabled or a new version is added. See [Use a vault reference](/docs/product/integrations/vaults/use-a-vault-reference).
## Rotate the client secret
1. In Entra ID, add a **second** client secret to the application.
2. In NocoDB, open **Edit vault** and re-enter every field: the vault URL, the tenant ID, the client ID and the new secret value. Click **Verify**, then **Save**.
3. Delete the old client secret in Entra ID.
Client secrets expire. Put the expiry date in your calendar, because an expired secret fails every connection that uses the vault. See [Rotating a vault's credentials](/docs/product/integrations/vaults#rotating-a-vaults-credentials).
## Common errors
| Message | What to do |
| --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| Azure Key Vault requires a vault URL, a tenant ID, a client ID and a client secret. | Fill in all four. Also returned when saving the vault, and nothing is saved |
| The vault URL must be a full URL, for example [https://my-vault.vault.azure.net](https://my-vault.vault.azure.net). | Enter the scheme and host |
| The vault URL must be an https\:// URL. | Use `https://` |
| That is not an Azure Key Vault URL. It must end in .vault.azure.net (or the equivalent suffix for your Azure cloud). | Copy the Vault URI from the vault's Overview page |
| The vault URL could not be resolved. Check the vault DNS name. | The vault name in the URL is misspelled, or the vault was deleted |
| No such vault at this URL. Check the vault DNS name on the Key Vault overview page. | Copy the URL from the vault's Overview page |
| Entra ID does not know this tenant. Check the directory (tenant) ID. | Copy the Directory (tenant) ID from the app registration's Overview page |
| Entra ID does not know this application in this tenant. Check the client ID and the tenant ID. | One of the two IDs is wrong, or the app lives in a different tenant |
| Entra ID rejected the client secret. Check it has not expired and was copied in full — the secret VALUE, not its ID. | Paste the Value column, or create a new secret if the old one expired |
| Key Vault rejected the token. Check the tenant ID and that the app registration has a Key Vault role or access policy. | The token was issued for another tenant, or the app has no access to this vault. Check step 2 |
| Key Vault refused the request. Check the app registration has a Key Vault role or access policy on this vault. | Check step 2 |
| The vault firewall does not allow NocoDB. Add NocoDB to the allowed networks on the vault. | Allow NocoDB's address through the vault's networking rules. Shown only by the test |
| Could not reach Key Vault at this URL. If the vault has a firewall or private endpoint, NocoDB must be allowed through it. | A network block, or a vault reachable only through a private endpoint |
| Key Vault did not answer in time. … | A slow or blocked network path. Retry, then check the vault's networking rules |
| The app registration is not allowed to read this secret. Give it the Key Vault Secrets User role, or a get access policy on this vault. | Step 2 is missing, or the role was assigned at a scope that does not include this vault. On a read, a firewall block also returns this message |
| No such secret in this vault. Check the secret name — Key Vault names are case-sensitive and contain no slashes. | Fix the name in the reference |
| This secret version is disabled in Key Vault. Enable it, or reference a version that is enabled. | Enable the current version in the portal |
| This Key Vault secret has no value. A disabled or expired version reads as empty. | Set a value, or enable the version |
| The secret name is empty. | Add the secret name to the reference |
| Could not test the vault connection in Azure Key Vault. Check the vault URL and the app registration's credentials and permissions. | Any other failure. The raw error is in the NocoDB server log |
For errors shared by every provider, see [Vaults troubleshooting](/docs/product/integrations/vaults/troubleshooting).
## Related
* [Enterprise Vaults overview](/docs/product/integrations/vaults)
* [Use a vault reference](/docs/product/integrations/vaults/use-a-vault-reference)
* [Vaults troubleshooting](/docs/product/integrations/vaults/troubleshooting)
---
## Related pages
- [Connect AWS Secrets Manager](https://nocodb.com/docs/product/integrations/vaults/aws-secrets-manager.md): Connect AWS Secrets Manager to NocoDB as an Enterprise vault: create an IAM policy, an IAM user and an access key, then reference secrets from your integrations.
- [Connect HashiCorp Vault](https://nocodb.com/docs/product/integrations/vaults/hashicorp-vault.md): Connect HashiCorp Vault to NocoDB as an Enterprise vault: write a policy, create an AppRole, then read secrets from a KV v2 mount in your integrations.
- [Connect Google Secret Manager](https://nocodb.com/docs/product/integrations/vaults/google-secret-manager.md): Connect Google Secret Manager to NocoDB as an Enterprise vault: create a service account with secret access, add its key, then reference secrets from your integrations.
- [Connect CyberArk Conjur](https://nocodb.com/docs/product/integrations/vaults/cyberark-conjur.md): Connect CyberArk Conjur to NocoDB as an Enterprise vault: load a policy with a host and variables, then reference the variables from your integrations with the host API key.
- [Use a Vault Reference](https://nocodb.com/docs/product/integrations/vaults/use-a-vault-reference.md): Point a credential on a NocoDB database connection, AI provider or authentication integration at a secret in a connected Enterprise vault instead of typing the value.
- [Vaults Troubleshooting](https://nocodb.com/docs/product/integrations/vaults/troubleshooting.md): What NocoDB Enterprise Vaults error messages mean and how to fix them: failed vault tests, references that fail at connection time or on save, and refused name, scope and disconnect changes.