Secret Server
× Azure Key Vault

In this integration model, Azure Key Vault functions as an External Vault — a secondary, cloud-native credential store that receives and, optionally, originates External Secrets synchronized from Secret Server. Secret Server remains the System of Record for privileged access governance: it owns rotation schedules, dependency tracking, access policies, and audit history.

The Azure Key Vault Sync Connector acts as a translation bridge — it handles field mapping between Secret Server's template model and Azure Key Vault's flat key-value secret format, manages sync state via version tokens, and enforces conflict resolution rules when both systems diverge between sync cycles.

All prerequisites must be validated in both environments before configuring the External Vault connector. Incomplete setup is the primary cause of failed initial External Secret synchronization.

The External Vault connector is configured in three phases: Azure AD identity setup, Key Vault RBAC assignment, then connector registration within Secret Server's External Vault panel.

Phase 1 — Azure AD App Registration & Credential

Create the App Registration that the External Vault connector will use to authenticate to Azure Key Vault. Use a certificate credential — not a client secret — to avoid credential sprawl.

# Create the App Registration for the External Vault connector
az ad app create \
  --display-name "SecretServer-ExternalVault-Connector" \
  --sign-in-audience "AzureADMyOrg"

# Create a self-signed cert for connector auth (or use enterprise PKI)
az ad app credential reset \
  --id "<APP_OBJECT_ID>" \
  --cert "@/path/to/connector.crt" \
  --append

# Create a service principal for the App Registration
az ad sp create --id "<APP_CLIENT_ID>"

# Assign Key Vault Secrets Officer at vault scope
az role assignment create \
  --role "Key Vault Secrets Officer" \
  --assignee "<APP_CLIENT_ID>" \
  --scope "/subscriptions/<SUB>/resourceGroups/<RG>/providers/Microsoft.KeyVault/vaults/<VAULT>"

Phase 2 — External Vault Registration in Secret Server

{
  "connectorType": "AzureKeyVault",
  "displayName": "akv-prod-eastus",
  "tenantId": "<AZURE_TENANT_ID>",
  "clientId": "<APP_CLIENT_ID>",
  "keyVaultUrl": "https://<vault-name>.vault.azure.net",
  "authMethod": "Certificate",          // Certificate | ManagedIdentity
  "syncMode": "Bidirectional",           // Bidirectional | PushOnly | PullOnly
  "syncIntervalSeconds": 300,
  "deltaSync": true,
  "externalSecretPrefix": "ss-prod",
  "autoTagExternalSecrets": true,
  "conflictResolution": "SecretServerWins",  // SecretServerWins | AzureWins | Manual
  "enginePoolId": 3
}

Secret Server organizes credentials using typed Secret Templates with named fields. Azure Key Vault stores External Secrets as flat name/value pairs with optional JSON content types. The connector's External Vault Template Mapper serializes SS template fields into structured JSON for AKV, and deserializes them back during pull operations.

Built-In Template Mappings

Defining a Custom External Vault Template Mapping

# External Vault Template Mapping for Oracle Service Account
external_vault_template_maps:
  - ss_template: "Oracle Service Account"
    external_vault: "akv-prod-eastus"
    "external_secret_prefix": "oracle"   # results in "oracle-{ss-id}"
    sync_direction: bidirectional
    content_type: "application/json"
    field_map:
      - ss_field: "Username"
        akv_key: "username"
        sensitive: false
      - ss_field: "Password"
        akv_key: "password"
        sensitive: true     # SS wins on conflict for sensitive fields
      - ss_field: "Server"
        akv_key: "host"
        sensitive: false    # AKV wins on conflict for infra fields
      - ss_field: "Port"
        akv_key: "port"
        type_coerce: string  # AKV stores all values as strings
    external_secret_tags:
      environment: "production"
      ss-managed: "true"       # required for pull filter
      ss-template: "oracle-service-account"

The External Vault sync engine follows a deterministic rule set to decide the direction, timing, and content of each External Secret synchronization cycle. Understanding these rules is essential for predicting system behavior under concurrent modification scenarios.

# Tags injected by connector onto every External Secret in AKV
ss-managed:        "true"
ss-secret-id:     "4821"
ss-template:      "oracle-service-account"
ss-folder-path:   "Production/Oracle/East"
ss-sync-version:  "83"           # SS internal version counter
ss-last-synced:   "2026-04-02T14:33:09Z"
ss-connector-id:  "akv-prod-eastus"

# /etc/ss-engine/akv-throttle.ini

[azure_key_vault]
max_requests_per_10s  = 2000   # AKV default service limit
burst_capacity        = 500    # token bucket burst
retry_policy          = "exponential"
retry_max_attempts    = 5
retry_base_delay_ms   = 1000

[sync_batching]
external_secrets_per_batch  = 25
batch_interval_ms           = 400
parallel_template_workers   = 4   # concurrent template map workers
delta_page_size              = 25   # AKV list page size

A sync conflict occurs when an External Secret is modified in both Secret Server and Azure Key Vault between polling cycles. The connector detects conflicts by comparing the AKV secret's ss-sync-version tag against Secret Server's current version counter before committing any write.

conflict_resolution:
  default_authority: secret_server
  merge_enabled: true
  sensitive_field_winner: secret_server
  infra_field_winner: azure_key_vault
  unresolvable_action: quarantine_and_alert
  alert_channel: "azure-monitor-webhook"

The integration's security architecture ensures that External Secret values never traverse the network in plaintext, access is governed by least-privilege identities on both platforms, and every operation produces a correlated, tamper-evident audit record across both systems.

Shared Responsibility Boundary

┌────────────────────────────────┬──────────────────────┬──────────────────────┐
│ Domain                         │ Secret Server        │ Azure Key Vault      │
├────────────────────────────────┼──────────────────────┼──────────────────────┤
│ Credential lifecycle / RPC     │ ✓ Owner              │ Replica              │
│ Access policy & check-out      │ ✓ Owner              │ IAM complement       │
│ Native cloud app delivery      │ Via External Secret  │ ✓ Owner              │
│ Key / cert custody (HSM)       │ AES-256 at-rest      │ ✓ Owner (FIPS HSM)   │
│ Rotation scheduling            │ ✓ Owner (RPC)        │ Triggered by push    │
│ Audit trail — PAM events       │ ✓ Owner              │ Correlated           │
│ Audit trail — API plane        │ Correlated           │ ✓ Owner (CloudTrail) │
│ Conflict resolution authority  │ ✓ Configurable       │ Field-level override │
└────────────────────────────────┴──────────────────────┴──────────────────────┘

Validate your understanding before deployment. Each question covers a key concept from this guide.

Check off every item before promoting the External Vault connector to production. This tracks completion within your current session.

Azure Infrastructure Hardening

• Key Vault configured with Azure RBAC authorization model (not access policies)
• Connector service principal has only Key Vault Secrets Officer — no broader roles
• Private Endpoint deployed; public network access disabled on the Key Vault
• Soft-delete enabled (90-day retention) and purge protection enabled on vault
• Azure Monitor diagnostic logs routed to Log Analytics Workspace
• Azure Policy in place to enforce ss-managed tag on all connector-created secrets
• Event Grid subscription configured for SecretNewVersionCreated events (near-RT pull)

Secret Server Configuration

• External Vault connector connection test passes all three checks (MSAL, GetSecret, Tag write)
• External Vault Template Maps validated against all in-scope secret templates in non-production
• Conflict resolution policy set and reviewed by security team (SecretServerWins default)
• External Secret prefix naming convention documented and applied to all template maps
• Pull filter (ss-managed tag) verified to be injected on all connector-pushed External Secrets

Operational Readiness

• Runbook created for manual conflict resolution and quarantine queue management
• Azure Monitor alerts configured for: sync failures, conflict events, quota throttling
• Rollback procedure documented (disable connector, restore prior AKV version)
• Consumer application teams informed of max External Secret cache TTL (≤ 60s)
• Cross-platform audit log correlation query validated in Log Analytics
• Connector certificate rotation scheduled in Secret Server RPC (90-day cycle)