lazysecrets/docs/azure.md

Azure Key Vault

lazysecrets reads Azure with your az CLI login: run az login once, and it reuses it.

Accounts

Every account signed in to az gets its own group in the Sources pane (az login again with another account to add one), and each account's vaults are read with that account. A subscription several accounts can see is listed under each, since their permissions can differ.

A service principal is used instead when AZURE_CLIENT_ID, AZURE_TENANT_ID and a secret or certificate are set in the environment.

If your az login expires mid-session, the status line says so: press L to run az login without leaving lazysecrets, and everything reloads.

Permissions

Vaults are discovered with Resource Graph, so you need read access to the vault resources (e.g. Reader). Key Vault data-plane access is separate (Azure RBAC or access policies). With RBAC, typically:

To	Role
list secrets, keys and certificates	Key Vault Reader
read secret values	Key Vault Secrets User
read certificate details	Key Vault Certificate User

A missing permission is shown in the pane, including the action that was denied.

Vaults you can't discover

A vault you can read but not see through Resource Graph can be pinned in the config; it's listed under "Pinned vaults" and read with az's default account:

providers:
  azure:
    vaults:
      - https://kv-foo.vault.azure.net/
    hideSubscriptions: [platform-mgmt] # by name or ID

What's shown

Secrets, keys and certificates, each on their own tab of the Secrets pane ([/]). space reveals a secret's value, or the public material of a key (PEM public key) or certificate; private key material is never fetched. v lists an item's versions. Items expiring within expiryWarningDays (30 by default) are marked ⚠ 12d, expired ones ✗.