Why Secret Rotation Matters More Than Ever

A large Azure tenant can hold hundreds of App Registrations, each with one or more client secrets, spread across many subscriptions. Microsoft’s own application management guidance recommends limiting certificate lifetimes to 180 days and moving away from client secrets altogether. Few teams manage that by hand.

Manual rotation is tedious and error-prone, and it stops working once you have a couple of hundred secrets across a dozen vaults. At that point you need to decide how to automate it.

The Three Pillars of Secret Rotation

Effective secret rotation rests on three pillars: discovery, rotation, and synchronisation. Miss any one of these and your rotation strategy has a blind spot.

1. Discovery: Know What You Have

You can’t rotate what you can’t find. Before implementing any rotation strategy, you need a complete inventory of:

  • Key Vault secrets across all subscriptions, including their expiry dates, creation dates, and which applications consume them
  • App Registration credentials like client secrets and certificates, many of which may have been created by developers who’ve since left the organisation
  • Service Principal secrets, which are often overlooked but equally critical

Azure Policy can flag non-compliant resources, but it doesn’t give you a unified view. You need tooling that scans across subscription boundaries and shows every secret in one list.

2. Rotation: Automate the Credential Lifecycle

Once you know what you have, the next step is automating the rotation itself. There are several approaches:

Key Vault’s built-in rotation covers keys and certificates, not secrets. Keys rotate on a rotation policy, and certificates from an integrated CA (DigiCert, GlobalSign) renew themselves. For secrets, Microsoft publishes a tutorial pattern in which Event Grid triggers an Azure Function that does the rotation. You build and run that Function yourself.

Custom Azure Functions can extend rotation to App Registration secrets, SQL connection strings, and other credential types. The pattern involves:

  1. Generating a new credential on the target resource
  2. Storing it in Key Vault as a new version
  3. Waiting for dependent services to pick up the new version
  4. Disabling the old credential

The critical detail here is step 3, the overlap window. Both the old and new credentials must be valid simultaneously to avoid downtime. This means your rotation logic needs to understand the dependency graph: which App Services, Functions, or Container Apps reference each secret.

Dedicated rotation platforms like CertifyClouds handle the full lifecycle (discovery, rotation, and sync) as a single coordinated operation. This eliminates the need to build and maintain custom Functions, manage Event Grid subscriptions, and handle failure scenarios yourself.

3. Synchronisation: Keep Consumers Updated

Rotating the secret doesn’t finish the job. After a secret is rotated in Key Vault, every consuming application needs the new value. This happens through several mechanisms:

  • Key Vault references in App Service / Azure Functions resolve secrets at runtime, but there’s a cache layer. Changes aren’t instant. By default, App Service refreshes Key Vault references every 24 hours.
  • Container Apps with Key Vault references have their own refresh cadence and require explicit configuration for volume-mounted secrets vs environment variable secrets.
  • Application-level caching is another factor. Your application code may cache connection strings or tokens at startup. A secret rotation means nothing if the app is still using the old cached value.

To handle this reliably, your rotation pipeline should either trigger application restarts after rotation, or your applications should implement secret refresh logic (polling Key Vault for version changes).

Zero-Downtime Rotation Pattern

The aim is rotation with zero downtime. The pattern:

  1. Create new secret version by generating a new credential (e.g., a new App Registration client secret) and storing it as a new Key Vault secret version
  2. Dual-credential window where both old and new credentials remain valid. Configure this window to be at least 2x your longest cache TTL
  3. Propagate to consumers by triggering App Service restarts, Container App revisions, or application-level refreshes
  4. Verify that all consumers are using the new credential (check application logs, health endpoints)
  5. Disable old credential only after verification, then remove or disable the previous credential
  6. Audit the entire operation for compliance

The rule that matters most: never delete the old credential before the new one is fully propagated. The overlap window is your safety net.

Monitoring and Alerting

Automation without monitoring is just automated failure. Set up alerts for:

  • Secrets expiring within 30/14/7 days to give your team time to investigate before automated rotation kicks in (or time to rotate manually if automation isn’t configured for that secret)
  • Rotation failures so you get immediate notification instead of a 3 AM production incident
  • Compliance drift to track your rotation compliance percentage over time. A healthy target is 95%+ of secrets rotated within policy

Azure Monitor and Log Analytics can capture Key Vault diagnostic logs, but correlating rotation events across subscriptions requires additional tooling or a centralised audit log.

Getting Started

If you’re starting from zero, here’s a pragmatic path:

  1. Audit: scan all subscriptions to build a complete secret inventory. Identify which secrets are already expired, which are expiring soon, and which have no expiry set at all (a common and dangerous pattern)
  2. Prioritise: start with production secrets and high-privilege App Registrations. Development and staging environments can wait
  3. Automate incrementally: begin with Key Vault’s native rotation for supported types, then extend to custom rotation for App Registration secrets
  4. Measure: track your compliance score and mean-time-to-rotate metrics

Or skip the build phase: CertifyClouds discovers your secrets, rotates App Registration secrets and certificates with an overlap window, and writes the new value to the Key Vaults, App Services, Function Apps, Container Apps, Logic Apps and Azure DevOps connections that use it. Copies it syncs to AWS, Google Cloud or another Key Vault are updated straight after the rotation, and the old credential stays in place while they catch up. Start a free 30-day trial.

Further Reading