lazysecrets/docs/azure.md

# Azure Key Vault

lazysecrets reads Azure with your az CLI login: run `az login` once, and
it reuses it.

## Accounts

Every account signed in to az gets its own group in the Sources pane
(`az login` again with another account to add one), and each account's
vaults are read with that account. A subscription several accounts can see
is listed under each, since their permissions can differ.

A service principal is used instead when `AZURE_CLIENT_ID`,
`AZURE_TENANT_ID` and a secret or certificate are set in the environment.

On an account's group row, the fourth pane shows who it signs in as: name,
user, tenant, object ID, whether the session used MFA, directory roles
(built-in ones by name) and its subscriptions, read from az's account list
and the token lazysecrets already has. Below them are the groups the
account is in, nested ones too: those come from Microsoft Graph, once a
session, the first time the pane shows them. `y` on the row copies the
object ID, the one access policies and role assignments ask for; `tab`
goes into the pane, where `j`/`k` pick any field or group, `/` filters
them (`/tenant`, `/platform`) and `y` copies the selected one.

If an account's az login has expired, the status line says so once, and the
Details pane on that account's rows says it until you sign in: press `L`
there to run `az login` for it without leaving lazysecrets, and everything
reloads.

## Permissions

Vaults are discovered with Resource Graph, so you need read access to the
vault resources (e.g. *Reader*). Key Vault data-plane access is separate
(Azure RBAC or access policies). With RBAC, typically:

| To | Role |
|---|---|
| list secrets, keys and certificates | *Key Vault Reader* |
| read secret values | *Key Vault Secrets User* |
| read certificate details | *Key Vault Certificate User* |

A missing permission is shown in the pane, including the action that was
denied.

## Vaults you can't discover

A vault you can read but not see through Resource Graph can be pinned in
the [config](config.md); it's listed under "Pinned vaults" and read with
az's default account:

```yaml
providers:
  azure:
    vaults:
      - https://kv-foo.vault.azure.net/
    hideSubscriptions: [platform-mgmt] # by name or ID
```

## What's shown

Secrets, keys and certificates, each on their own tab of the Secrets pane
(`[`/`]`). `space` reveals a secret's value, or the public material of a
key (PEM public key) or certificate; private key material is never
fetched. `v` lists an item's versions. Items expiring within
`expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.

The status pane (`0`) lists them across every vault loaded, opened or
cached, soonest first, and its line counts them (`⚠ 3 expiring`); `enter`
on one goes to it. That makes no requests of its own: expiry dates come
with the lists. It says how many vaults it covers; `ctrl+a` in search
loads the rest.

For a pipeline or a cron job, `lazysecrets expiring` lists them in every
vault of every account, loading each vault's lists (a few at a time):

```sh
$ lazysecrets expiring --days 30
LEFT     EXPIRES     TYPE         VAULT        NAME     LINK
expired  2026-03-01  certificate  kv-app-prod  old-tls  lazysecrets://azure/kv-app-prod.vault.azure.net/certificates/old-tls
12d      2026-10-23  secret       kv-app-prod  api-key  lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/api-key
```

`--days` defaults to `expiryWarningDays`. Accounts that need a sign-in and
lists it can't read are named on stderr, one line each. Like grep, it
exits 0 when nothing expires, 1 when it lists something, and 2 when it
couldn't check everything.

On a vault, the right pane shows its settings: resource group, location,
SKU, whether access is by Azure roles or access policies, soft delete and
purge protection, which networks can reach it, private endpoints and tags.
They come with the list of vaults, so they cost no extra requests and are
cached with it.