Skip to main content

​
What is the Azure Key Vault integration?

The Azure Key Vault integration connects Prizm to Azure Key Vault, enabling connector credentials — passwords, API tokens, connection strings — to be retrieved from Azure Key Vault at runtime rather than stored in Prizm. Prizm authenticates with Azure Key Vault using a service principal via the client credentials flow, reads the requested secret, and uses it to establish the data source connection. No credential is persisted in Prizm’s database.

​
What this integration enables

​
Using Azure Key Vault with Prizm

Once the Azure Key Vault integration is active, it becomes available as a credential source when creating or editing connectors in Prizm. Instead of entering a password or token directly, you reference the secret name in Azure Key Vault and Prizm retrieves the credential at runtime using the configured service principal. When creating or editing a connector, locate the Credentials section. Instead of entering a password directly, click Use Vault and select the Azure Key Vault integration you configured. Enter the secret name as it appears in Azure Key Vault (e.g., snowflake-prod-password). Save the connector. Prizm retrieves that secret from Key Vault each time the connector needs to establish a connection.

​
How credential retrieval works at runtime

When Prizm needs to connect to a data source through an Azure Key Vault-backed connector, it requests an access token from Azure AD using the configured service principal via the client credentials flow. It then calls the Azure Key Vault Secrets API to retrieve the named secret. The retrieved value is used for the connection and discarded after use — it is not written to Prizm’s database or any log.

​
Credential rotation

When a credential is rotated in Azure Key Vault, create a new secret version with the updated value using the same secret name. No changes are needed in Prizm. The next time the connector establishes a connection, Prizm automatically retrieves the latest active version of the secret.
Set an expiration date on your Azure Key Vault secrets that aligns with your organization’s credential rotation policy. Azure will warn you when a secret is nearing expiry, giving you time to rotate before Prizm loses access. Combine this with Azure Monitor alerts on secret expiry events for proactive notification.

Setup

Connect Azure Key Vault to Prizm — step-by-step configuration guide.