diff --git a/internal/listing/listing.go b/internal/listing/listing.go
index ef9b4c2..73d4d2a 100644
--- a/internal/listing/listing.go
+++ b/internal/listing/listing.go
@@ -51,6 +51,11 @@ type Entry struct {
 	Enabled *bool     `json:"enabled,omitempty"`
 	// Note is the user's note on it, if any.
 	Note string `json:"note,omitempty"`
+	// Reference is how config refers to a secret, where the provider has
+	// a way (@Microsoft.KeyVault(...), {{secrets/scope/key}}); URL its
+	// web page (portal, workspace), if any.
+	Reference string `json:"reference,omitempty"`
+	URL       string `json:"url,omitempty"`
 	// Error says why a source's vaults or a vault's secrets couldn't be
 	// listed. The entry is then that source or vault, again, or with an
 	// account's sources unreadable, the account without a link.
@@ -207,12 +212,12 @@ func (l *lister) objects(p provider.Provider, c provider.Container, objs []provi
 		}
 		l.put(p, Entry{Link: r.String(), Kind: strings.ToLower(string(o.Type)), Provider: kindOf(c.Source.Kind),
 			Path: []string{c.Source.Name, c.Name, o.Name}, AccountLabel: accountOf(c.Source),
-			Expires: o.Expires, Enabled: o.Enabled})
+			Expires: o.Expires, Enabled: o.Enabled, Reference: o.Reference, URL: o.URL})
 	}
 }
 
 func sourceEntry(src provider.Source) Entry {
-	e := Entry{Kind: "source", Provider: kindOf(src.Kind), Path: []string{src.Name}, AccountLabel: accountOf(src)}
+	e := Entry{Kind: "source", Provider: kindOf(src.Kind), Path: []string{src.Name}, AccountLabel: accountOf(src), URL: src.URL}
 	if r, err := ref.ForSource(src); err == nil {
 		e.Link = r.String()
 	}
@@ -220,7 +225,7 @@ func sourceEntry(src provider.Source) Entry {
 }
 
 func containerEntry(c provider.Container) Entry {
-	e := Entry{Kind: "vault", Provider: kindOf(c.Source.Kind), Path: []string{c.Source.Name, c.Name}, AccountLabel: accountOf(c.Source)}
+	e := Entry{Kind: "vault", Provider: kindOf(c.Source.Kind), Path: []string{c.Source.Name, c.Name}, AccountLabel: accountOf(c.Source), URL: c.URL}
 	if r, err := ref.ForContainer(c, provider.TypeSecret); err == nil {
 		e.Link = r.String()
 	}
diff --git a/internal/listing/listing_test.go b/internal/listing/listing_test.go
index f09b019..13167f4 100644
--- a/internal/listing/listing_test.go
+++ b/internal/listing/listing_test.go
@@ -87,6 +87,11 @@ func TestListLoadsAndCaches(t *testing.T) {
 			t.Errorf("provider %q", e.Provider)
 		}
 	}
+	for _, e := range got {
+		if e.Kind == "secret" && e.Provider == "azure" && (!strings.HasPrefix(e.Reference, "@Microsoft.KeyVault(") || e.URL == "") {
+			t.Errorf("%s: reference %q, url %q", e.Link, e.Reference, e.URL)
+		}
+	}
 	if len(f.Sources) != 1 || len(f.Containers) == 0 || len(f.Objects) == 0 {
 		t.Errorf("not cached: %d sources, %d containers, %d objects", len(f.Sources), len(f.Containers), len(f.Objects))
 	}