# Azure Key Vault

lazysecrets reads Azure with your az CLI login: run `az login` once, and
it reuses it.

## Accounts

Every account signed in to az gets its own group in the Sources pane
(`az login` again with another account to add one), and each account's
vaults are read with that account. A subscription several accounts can see
is listed under each, since their permissions can differ.

A service principal is used instead when `AZURE_CLIENT_ID`,
`AZURE_TENANT_ID` and a secret or certificate are set in the environment.

On an account's group row, the fourth pane shows who it signs in as: name,
user, tenant, object ID, whether the session used MFA, directory roles
(built-in ones by name) and its subscriptions, read from az's account list
and the token lazysecrets already has. Below them are the groups the
account is in, nested ones too: those come from Microsoft Graph, once a
session, the first time the pane shows them. `y` on the row copies the
object ID, the one access policies and role assignments ask for; `tab`
goes into the pane, where `j`/`k` pick any field or group and `y` copies
it.

If an account's az login has expired, the status line says so once, and the
Details pane on that account's rows says it until you sign in: press `L`
there to run `az login` for it without leaving lazysecrets, and everything
reloads.

## Permissions

Vaults are discovered with Resource Graph, so you need read access to the
vault resources (e.g. *Reader*). Key Vault data-plane access is separate
(Azure RBAC or access policies). With RBAC, typically:

| To | Role |
|---|---|
| list secrets, keys and certificates | *Key Vault Reader* |
| read secret values | *Key Vault Secrets User* |
| read certificate details | *Key Vault Certificate User* |

A missing permission is shown in the pane, including the action that was
denied.

## Vaults you can't discover

A vault you can read but not see through Resource Graph can be pinned in
the [config](config.md); it's listed under "Pinned vaults" and read with
az's default account:

```yaml
providers:
  azure:
    vaults:
      - https://kv-foo.vault.azure.net/
    hideSubscriptions: [platform-mgmt] # by name or ID
```

## What's shown

Secrets, keys and certificates, each on their own tab of the Secrets pane
(`[`/`]`). `space` reveals a secret's value, or the public material of a
key (PEM public key) or certificate; private key material is never
fetched. `v` lists an item's versions. Items expiring within
`expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.