Overview

In this section, you will learn how to rotate user credentials within the Azure network environment across various target systems. Rotation works on the devices configured and attached to the Azure Active Directory (Azure AD) which can also be your default directory.

KeeperPAM can rotate the password for Azure AD users, service accounts, local admin users, local users, managed services, databases and more.

KeeperPAM Record Types

Configurations for the Azure Active Directory are defined in the PAM Configuration section of Keeper Secrets Manager.

Configurations for the Azure AD joined devices are defined in the PAM Directory, PAM Machine, and PAM Database record types. The credentials and user accounts are defined in PAM User records. The following table shows the supported Azure AD joined devices with Keeper Rotation and their corresponding PAM Record Type:

Prerequisites for Rotation

Prior to rotating user credentials within your Azure environment, you need to make sure you have the following information and configurations in place:

1. All Azure AD joined devices that you want to use with Rotation need to be created and configured within your Azure Active Directory

2. To successfully configure and setup Rotation within your Azure Network, the following values are needed for your PAM Configuration:

1. Make sure all the Azure services or Azure AD joined devices you plan on using for rotation have access to the Azure Active Directory.

2. Create a custom role to allow application to access/perform actions on various Azure resources. For more information see the Azure Environment Setup document.

Setup Steps

At a high level, the following steps are needed to successfully rotate passwords on your Azure network:

1. Create Shared Folders to hold the PAM records involved in rotation

2. Create PAM Machine, PAM Database and PAM Directory records representing each resource

3. Create PAM User records that contain the necessary account credentials for each resource

4. Link the PAM User record to the PAM Resource record.

5. Assign a Secrets Manager Application to all of the shared folders that hold the PAM records

6. Install a Keeper Gateway and add it to the Secrets Manager application

7. Create a PAM Configuration with the Azure environment setting

8. Configure Rotation settings on the PAM User records

Use Cases:

• Azure AD Users

• Azure VM Local Users

• Azure Managed Database

• Azure App Secret

In this section, you will learn how to rotate DB User or Admin credentials on the following Azure Managed Databases:

• Azure SQL

• Azure MySQL

• Azure MariaDB

• Azure PostgreSQL

Overview

For Azure Managed PostgreSQL database, the Azure SDK will be used to rotate the password of Database Admin Accounts. To rotate the passwords of Regular Database Users, Keeper connects to the DB instance with the provided admin credentials and executes the necessary SQL statements to change the password.

Prerequisites

This guide assumes the following tasks have already taken place:

• Your Keeper Gateway is able to communicate with the Azure Managed PostgreSQL database

1. Set up a PAM Database Record

The PAM Database record links to the admin credentials and necessary configurations to connect to the PostgreSQL Server on Azure. Keeper Rotation will use these provided configurations to rotate passwords of regular database user accounts in the Azure PostgreSQL Server instance. These provided admin credentials need to also have sufficient database permissions to successfully change the credentials of the database user accounts.

The following table lists all the required fields on the PAM Database Record:

Note: Adding Provider Group, Provider Region, and Database ID will enable managing the PAM Database Record through the Azure SDK.

This PAM Database Record with the admin credential needs to be in a shared folder that is shared to the KSM application created in the pre-requisites. Only the KSM application needs access to this privileged account, it does not need to be shared with any users.

2. Set up PAM Configuration

Note: You can skip this step if you already have a PAM Configuration set up for this environment..

If you are creating a new PAM Configuration, login to the Keeper Vault and select "Secrets Manager", then select the "PAM Configurations" tab, and click on "New Configuration". The following table lists all the required fields on the PAM Configuration Record:

3. Set up one or more PAM User records

Keeper Rotation will use the linked credentials in the PAM Database record to rotate the PAM User records on your Azure environment. The PAM User credential needs to be in a shared folder that is shared to the KSM application created in the prerequisites.

The following table lists all the required fields on the PAM User record:

4. Configure Rotation on the PAM User records

Select the PAM User record(s) from Step 3, edit the record and open the "Password Rotation Settings".

• Select the desired schedule and password complexity.

• The "Rotation Settings" should use the PAM Configuration setup previously.

• The "Resource Credential" field should select the PAM Database credential setup from Step 1.

• Upon saving, the rotation button will be enabled and available to rotate on demand, or via the selected schedule.

Any user with edit rights to a PAM User record has the ability to setup rotation for that record.