Azure Key Vault

Configure Azure authentication, vault access, and a test secret for Azure Key Vault.

Azure setup

Everything you need to use Envilder with Azure Key Vault.

1. Authenticate with Azure

Envilder uses Azure Default Credentials. Log in with:

az login

Provide the vault URL via $config in your map file or the --vault-url CLI flag.

2. Configure vault access

Check which access model your vault uses:

az keyvault show --name {VAULT_NAME}   --query properties.enableRbacAuthorization

true → Azure RBAC (recommended)
false / null → Vault Access Policy (classic)

Option A: Azure RBAC (recommended)

az role assignment create   --role "Key Vault Secrets Officer"   --assignee {YOUR_OBJECT_ID}   --scope /subscriptions/{SUB}/resourceGroups/{RG}/providers/Microsoft.KeyVault/vaults/{VAULT}

Option B: Vault Access Policy

az keyvault set-policy   --name {VAULT_NAME}   --object-id {YOUR_OBJECT_ID}   --secret-permissions get set list

3. Required permissions

Operation	Permission
Pull	Get
Push	Set

For pull-only access, Key Vault Secrets User role is sufficient.

4. Create a test secret and verify

Push a test secret with Envilder, which also writes the map file, then pull it back to confirm everything works:

# 1. Push a test secret; Envilder also writes azure-test-map.json
envilder --push --provider=azure --vault-url=https://{VAULT_NAME}.vault.azure.net \
  --map=azure-test-map.json --key=HELLO --value=world --secret-path=test-hello

# 2. Pull it back with Envilder
envilder --map=azure-test-map.json --envfile=.env

If you see ⭐ LEVEL CLEARED, your Azure setup is complete.

Or load secrets directly from your app with the Python SDK:

from envilder import Envilder

secrets = Envilder.load("azure-test-map.json")
print(secrets["HELLO"])  # world