Azure Key Vault vaults

Register Azure Key Vault as a first-class secret vault in PowerShell Universal for secret variables and credentials.

PowerShell Universal can register Azure Key Vault as a first-class secret vault. Registered vaults are managed in-process, appear in vault selectors for secret variables and credentials, and are stored in .universal/secretVaults.ps1.

Create a vault

1. Go to Manage > Variables & Secrets > Vaults and select Create.
2. Enter a vault name and its Azure Key Vault URI, such as https://production.vault.azure.net/.
3. Select an authentication method and supply its required values.
4. Save the vault, then select it when creating a secret variable or credential.

Existing SecretManagement registrations remain available, but are list-only on the Vaults page. Use this flow for new Azure Key Vault registrations.

Authentication methods

Method	Configuration
Default	Uses DefaultAzureCredential from the host environment.
Managed identity	Uses the system-assigned managed identity by default. Provide a managed identity client ID for a user-assigned identity.
Client secret	Provide the Entra tenant ID, application client ID, and the name of a PSU secret variable that stores the application client secret. The secret value is not stored in the vault registration.

Use PowerShell

Create a registration that uses the system-assigned managed identity:

New-PSUSecretVault -Name 'Production Key Vault' `
    -VaultUri 'https://production.vault.azure.net/' `
    -AuthenticationType ManagedIdentity

Create a registration that uses an Entra application registration:

New-PSUSecretVault -Name 'Customer Key Vault' `
    -VaultUri 'https://customer.vault.azure.net/' `
    -AuthenticationType ClientSecret `
    -TenantId '00000000-0000-0000-0000-000000000000' `
    -ClientId '11111111-1111-1111-1111-111111111111' `
    -ClientSecretVariable 'AzureKeyVaultClientSecret'

Use Get-PSUSecretVault, Set-PSUSecretVault, and Remove-PSUSecretVault to manage registrations remotely. The value referenced by ClientSecretVariable must be a PSU secret variable.