> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> What the Azure Key Vault integration is in Prizm — retrieves connector credentials at runtime via a service principal instead of storing them.

<script type="application/ld+json">
  {`{
            "@context": "https://schema.org",
            "@type": "TechArticle",
            "headline": "Azure Key Vault Overview",
            "description": "What the Azure Key Vault integration is in Prizm - retrieves connector credentials at runtime via a service principal instead of storing them.",
            "url": "https://docs.dqlabs.ai/integrations/azure-key-vault/overview",
            "publisher": {
              "@type": "Organization",
              "name": "DQLabs Inc",
              "logo": "https://media.brand.dev/332adc35-5bc4-4d2b-bf78-256aa4a5e414.svg"
            }
            }`}
</script>

## What is the Azure Key Vault integration?

The Azure Key Vault integration connects Prizm to Azure Key Vault, enabling connector credentials — passwords, API tokens, connection strings — to be retrieved from Azure Key Vault at runtime rather than stored in Prizm. Prizm authenticates with Azure Key Vault using a service principal via the client credentials flow, reads the requested secret, and uses it to establish the data source connection. No credential is persisted in Prizm's database.

### What this integration enables

| Capability                       | Description                                                                                                        |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Dynamic credential retrieval     | Prizm fetches credentials from Azure Key Vault at connection time, not at configuration time.                      |
| Service principal authentication | Authenticates using Azure AD client credentials flow — no user login required.                                     |
| Any Azure region                 | Works with Key Vaults in any Azure region.                                                                         |
| Zero credential storage          | Credentials are never persisted in Prizm's database.                                                               |
| Automatic rotation               | When a credential is rotated in Azure Key Vault, connectors in Prizm pick up the new value on the next connection. |

### Using Azure Key Vault with Prizm

Once the Azure Key Vault integration is active, it becomes available as a credential source when creating or editing connectors in Prizm. Instead of entering a password or token directly, you reference the secret name in Azure Key Vault and Prizm retrieves the credential at runtime using the configured service principal.

When creating or editing a connector, locate the **Credentials** section. Instead of entering a password directly, click **Use Vault** and select the Azure Key Vault integration you configured. Enter the **secret name** as it appears in Azure Key Vault (e.g., `snowflake-prod-password`). Save the connector. Prizm retrieves that secret from Key Vault each time the connector needs to establish a connection.

### How credential retrieval works at runtime

When Prizm needs to connect to a data source through an Azure Key Vault-backed connector, it requests an access token from Azure AD using the configured service principal via the client credentials flow. It then calls the Azure Key Vault Secrets API to retrieve the named secret. The retrieved value is used for the connection and discarded after use — it is not written to Prizm's database or any log.

### Credential rotation

When a credential is rotated in Azure Key Vault, create a new secret version with the updated value using the same secret name. No changes are needed in Prizm. The next time the connector establishes a connection, Prizm automatically retrieves the latest active version of the secret.

<Tip>
  Set an expiration date on your Azure Key Vault secrets that aligns with your organization's credential rotation policy. Azure will warn you when a secret is nearing expiry, giving you time to rotate before Prizm loses access. Combine this with Azure Monitor alerts on secret expiry events for proactive notification.
</Tip>

<Card title="Setup" icon="gear" href="/integrations/azure-key-vault/setup">
  Connect Azure Key Vault to Prizm — step-by-step configuration guide.
</Card>