Hello world 👋

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/azure.md

@@ -0,0 +1,54 @@
+# Azure Key Vault
+
+lazysecrets reads Azure with your az CLI login: run `az login` once, and
+it reuses it.
+
+## Accounts
+
+Every account signed in to az gets its own group in the Sources pane
+(`az login` again with another account to add one), and each account's
+vaults are read with that account. A subscription several accounts can see
+is listed under each, since their permissions can differ.
+
+A service principal is used instead when `AZURE_CLIENT_ID`,
+`AZURE_TENANT_ID` and a secret or certificate are set in the environment.
+
+If your az login expires mid-session, the status line says so: press `L` to
+run `az login` without leaving lazysecrets, and everything reloads.
+
+## Permissions
+
+Vaults are discovered with Resource Graph, so you need read access to the
+vault resources (e.g. *Reader*). Key Vault data-plane access is separate
+(Azure RBAC or access policies). With RBAC, typically:
+
+| To | Role |
+|---|---|
+| list secrets, keys and certificates | *Key Vault Reader* |
+| read secret values | *Key Vault Secrets User* |
+| read certificate details | *Key Vault Certificate User* |
+
+A missing permission is shown in the pane, including the action that was
+denied.
+
+## Vaults you can't discover
+
+A vault you can read but not see through Resource Graph can be pinned in
+the [config](config.md); it's listed under "Pinned vaults" and read with
+az's default account:
+
+```yaml
+providers:
+  azure:
+    vaults:
+      - https://kv-foo.vault.azure.net/
+    hideSubscriptions: [platform-mgmt] # by name or ID
+```
+
+## What's shown
+
+Secrets, keys and certificates, each on their own tab of the Secrets pane
+(`[`/`]`). `space` reveals a secret's value, or the public material of a
+key (PEM public key) or certificate; private key material is never
+fetched. `v` lists an item's versions. Items expiring within
+`expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.