> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Prerequisites
> Azure configuration required before connecting Azure Key Vault to Prizm — service principal, client secret, and Key Vault access.
## Azure Key Vault Prerequisites
Complete these steps in the Azure portal before configuring the integration in Prizm.
### What you need
* An Azure subscription with a Key Vault already created
* Permission to create app registrations in Azure Active Directory (Application Developer role or higher)
* Permission to assign roles on the Key Vault (Owner or User Access Administrator)
* Connector credentials already stored as secrets in the Key Vault
### Sample secret value for an ADLS connector
For an Azure Data Lake Storage (ADLS) connector, store the service principal credentials as a single JSON secret in the Key Vault, with the client ID, client secret, and tenant ID as keys:
```json theme={null}
{
"client_id": "",
"client_secret": "",
"tenant_id": ""
}
```
Prizm reads this JSON secret from the Key Vault and uses the three values to authenticate the ADLS connection via the Azure AD client credentials flow.
Use placeholder values like the ones above when documenting or sharing this format. Never paste a real `client_secret` into documentation, tickets, or chat — treat it as a live credential and rotate it immediately if it has been exposed.
***
## Step 1 — Register an application in Azure Active Directory
In the Azure portal, navigate to **Azure Active Directory** → **App registrations** → **New registration**.
* **Name**: Enter a descriptive name (e.g., `Prizm Key Vault Integration`)
* **Supported account types**: Leave as **Accounts in this organizational directory only**
* Click **Register**
On the app registration overview page, note:
* **Application (client) ID** — needed for Prizm
* **Directory (tenant) ID** — needed for Prizm
***
## Step 2 — Create a client secret
In the app registration, navigate to **Certificates & secrets** → **Client secrets** → **New client secret**.
* **Description**: Enter a label (e.g., `Prizm integration`)
* **Expires**: Choose an expiry period that aligns with your rotation policy (e.g., 12 months)
* Click **Add**
Immediately copy the generated **Value**. This is your client secret and is only shown once. The entry remains visible in the list afterward, but only the Secret ID is shown — not the value.
Set a reminder to rotate this secret before it expires. When you create a replacement, update the value in Prizm before deactivating the old secret to avoid interrupting connector access.
***
## Step 3 — Assign Key Vault access to the service principal
Open your Key Vault in the Azure portal. Navigate to **Access control (IAM)** → **Add role assignment**.
On the **Role** tab, select **Key Vault Secrets User**.
On the **Members** tab:
* Set **Assign access to**: **User, group, or service principal**
* Click **Select members**, search for the app registration name from Step 1, and select it
* Click **Review + assign**
Confirm the assignment is active under **Access control (IAM)** → **Role assignments**.
***
## Step 4 — Locate your Key Vault URI
Open your Key Vault in the Azure portal. On the **Overview** page, copy the **Vault URI** (e.g., `https://yourkeyvault.vault.azure.net`). This is the Vault Address you will enter in Prizm.
***
## Summary — values needed for Prizm
| Value | Where to find it |
| ----------------- | ----------------------------------------------------------- |
| **Vault Address** | Key Vault **Overview** → **Vault URI** |
| **Tenant ID** | App registration **Overview** → **Directory (tenant) ID** |
| **Client ID** | App registration **Overview** → **Application (client) ID** |
| **Client Secret** | Value copied in Step 2 |
Enter the above values in Prizm to complete the integration.