---
title: "Azure Key Vault key stores - Amplia"
description: "Configure Azure Key Vault key stores in Amplia, a cloud HSM option compatible with all supported platforms, from app registration to secret."
canonical: "https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/key-stores/azure"
locale: "en"
product: "Amplia"
last_updated: "2026-10-12"
---

# Azure Key Vault key stores - Amplia

> **Note**
>
> Azure Key Vault stores are compatible with all supported platforms

[Azure Key Vault](https://azure.microsoft.com/en-us/services/key-vault/) can be thought of as a cloud HSM. Keys are stored on FIPS 140-2 Level 2
validated HSMs for a relatively low cost of ~5 dollars per month per key. This service from Microsoft has enabled the employment of HSMs on
projects which otherwise would not have the necessary budget.

> **Tip**
>
> Lacuna Software's cloud-based Amplia instance (SaaS offering) stores all CA keys on Azure Key Vault, and we highly recommend it
> for instances installed both on the cloud or on local servers.

## Procedure

To configure an Azure Key Vault key store on Amplia, log in [Azure portal](https://portal.azure.com) and use the following settings:

### Creating an application and authentication secret

Create an application corresponding to your Amplia instance:

1. In the option **Microsoft Entra ID**, go to **App registrations** and click **New registration**
1. Enter a name for the application
1. Leave the rest of the fields in the default options
1. Click on **Register**

Once the application is created, take note of the **Application (client) ID**.

Generate a secret for application identification:

1. In the application settings, click **Certificates & secrets**
1. In **Client secrets**, click **New client secret**
1. Fill in a description and choose an expiration
1. Click **Add**
1. **Copy the displayed value** in column **Value** (it will not be possible to recover this value later!)

> **Warning**
>
> Client secrets always expire (the longest expiration available is 24 months). Before the secret expires, generate a new one and update
> the **AppKey** setting, otherwise Amplia will no longer be able to access the Key Vault. To avoid this, you can authenticate with a
> certificate instead (see the **CertThumb** setting below).

### Creating the Key Vault

Create the Key Vault (skip this part if you want to use an existing Key Vault):

1. In the option **Key vaults**, click **Create**
1. Fill in the data according to your infrastructure
1. In the *Pricing tier* option, choose **Premium** to be able to generate keys stored in HSM
1. On the **Access configuration** tab, keep the default *Permission model*, **Azure role-based access control**
1. Click **Review + create**
1. Click **Create**

Once the creation of the Key Vault is complete, click **Go to resource**. Then, take note of the Key Vault's **Vault URI**, shown on the
*Overview* page (ex: `https://my-key-vault.vault.azure.net/`).

### Granting permissions to the application

How to grant permissions to the application depends on the *Permission model* of the Key Vault, shown on **Settings** > **Access configuration**.
New Key Vaults use **Azure role-based access control** by default. Older Key Vaults may use **Vault access policy** instead.

If the Key Vault uses **Azure role-based access control**:

1. In the Key Vault, click **Access control (IAM)**, then **Add** > **Add role assignment**
1. On the **Role** tab, select **Key Vault Crypto Officer** and click **Next**
1. On the **Members** tab, choose **User, group, or service principal** and click **Select members**
1. Select the created application and click **Select**
1. Click **Review + assign**, then click **Review + assign** again to confirm

> **Note**
>
> The **Key Vault Crypto Officer** role is required because Amplia creates keys on the Key Vault. The **Key Vault Crypto User** role does not
> allow creating keys.

If the Key Vault uses **Vault access policy**:

1. In the Key Vault settings, click **Access policies**, then **Create**
1. On the **Permissions** tab, without using a template, select only the following *Key permissions*: **Get**, **List**, **Create**, **Verify** and **Sign**. Then click **Next**
1. On the **Principal** tab, select the created application and click **Next**
1. Click **Next** until you reach the review step, then click **Create**

### Amplia configuration

Edit your JSON configuration file or your App Service settings and add a section with a name to the **KeyStores** section
that identifies the Key Vault (see example below), and place the following settings in it:

* **Type**: `AzureKeyVault`
* **Endpoint**: Vault URI of the key vault (shown on the key vault's *Overview* page) -- e.g.: https://my-pki.vault.azure.net/
* **AppId**: Application ID to be used to authenticate with Azure
* **AppKey**: Application secret key to be used to authenticate with Azure (for additional security, omit this value and specify the `CertThumb` instead)
* **CertThumb**: thumbprint of the certificate to be used to authenticate with Azure (hex-encoded, as provided by the Azure Portal)
* **TenantId** (optional, Amplia 5.0 or later): ID of the Microsoft Entra tenant to authenticate with. If omitted, the tenant is taken from the Key Vault's authentication challenge
* **UseManagedIdentity** (Amplia 5.0 or later): set to `true` to authenticate with the managed identity of the host where Amplia runs (for instance, the managed identity of its App Service)
  instead of an application secret or certificate. In this case, leave **AppKey** and **CertThumb** blank, and grant the permissions described above to the managed identity instead of an application
* **UseHsm**: by default, [HSM-protected](https://docs.microsoft.com/en-us/azure/key-vault/key-vault-hsm-protected-keys) keys are created. To use "software"
  keys, set this value to `false`

Example (*.ini* or *.conf* configuration file):

```ini
[KeyStores:MyKeyVault]
Type=AzureKeyVault
Endpoint=https://xxx.vault.azure.net/
AppId=00000000-0000-0000-0000-000000000000
AppKey=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
```

Example (environment variables):

```sh
KeyStores__MyKeyVault__Type=AzureKeyVault
KeyStores__MyKeyVault__Endpoint=https://xxx.vault.azure.net/
KeyStores__MyKeyVault__AppId=00000000-0000-0000-0000-000000000000
KeyStores__MyKeyVault__AppKey=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
```

Example (*.json* configuration file):

```json
"KeyStores": {
	...,
	"MyKeyVault": {
		"Type": "AzureKeyVault",
		"Endpoint": "https://xxx.vault.azure.net/",
		"AppId": "00000000-0000-0000-0000-000000000000",
		"AppKey": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
	},
	...
}
```

## See also

* [Key Stores](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/key-stores)
* [Amplia on premises](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises)