Skip to main content

​
Azure Key Vault Prerequisites

Complete these steps in the Azure portal before configuring the integration in Prizm.

​
What you need

  • An Azure subscription with a Key Vault already created
  • Permission to create app registrations in Azure Active Directory (Application Developer role or higher)
  • Permission to assign roles on the Key Vault (Owner or User Access Administrator)
  • Connector credentials already stored as secrets in the Key Vault

​
Sample secret value for an ADLS connector

For an Azure Data Lake Storage (ADLS) connector, store the service principal credentials as a single JSON secret in the Key Vault, with the client ID, client secret, and tenant ID as keys:
Prizm reads this JSON secret from the Key Vault and uses the three values to authenticate the ADLS connection via the Azure AD client credentials flow.
Use placeholder values like the ones above when documenting or sharing this format. Never paste a real client_secret into documentation, tickets, or chat — treat it as a live credential and rotate it immediately if it has been exposed.

​
Step 1 — Register an application in Azure Active Directory

In the Azure portal, navigate to Azure Active Directory → App registrations → New registration.
  • Name: Enter a descriptive name (e.g., Prizm Key Vault Integration)
  • Supported account types: Leave as Accounts in this organizational directory only
  • Click Register
On the app registration overview page, note:
  • Application (client) ID — needed for Prizm
  • Directory (tenant) ID — needed for Prizm

​
Step 2 — Create a client secret

In the app registration, navigate to Certificates & secrets → Client secrets → New client secret.
  • Description: Enter a label (e.g., Prizm integration)
  • Expires: Choose an expiry period that aligns with your rotation policy (e.g., 12 months)
  • Click Add
Immediately copy the generated Value. This is your client secret and is only shown once. The entry remains visible in the list afterward, but only the Secret ID is shown — not the value.
Set a reminder to rotate this secret before it expires. When you create a replacement, update the value in Prizm before deactivating the old secret to avoid interrupting connector access.

​
Step 3 — Assign Key Vault access to the service principal

Open your Key Vault in the Azure portal. Navigate to Access control (IAM) → Add role assignment. On the Role tab, select Key Vault Secrets User. On the Members tab:
  • Set Assign access to: User, group, or service principal
  • Click Select members, search for the app registration name from Step 1, and select it
  • Click Review + assign
Confirm the assignment is active under Access control (IAM) → Role assignments.

​
Step 4 — Locate your Key Vault URI

Open your Key Vault in the Azure portal. On the Overview page, copy the Vault URI (e.g., https://yourkeyvault.vault.azure.net). This is the Vault Address you will enter in Prizm.

​
Summary — values needed for Prizm

Setup

Enter the above values in Prizm to complete the integration.