1 of 1

Azure Plugin

Rotate Azure AD account passwords

Keeper has launched a new Password Rotation feature with Keeper Secrets Manager. This new capability is recommended for all password rotation use cases. The Documentation is linked below:

Password Rotation with Keeper Secrets Manager

This plugin generates/rotates Azure AD password for any user.

Prerequisites

Install Microsoft Authentication Library (MSAL) for Python

pip install msal

Configure Azure Application to have User Administrative Privileges

Configure Azure Application for Rotation

Follow these steps as one-time setup for Azure rotation

Steps to register new application

Navigate to new app registration page:
Azure portal -> Azure Active Directory -> App Registrations -> New Registration
Give a name to the application and leave Supported account type as "Accounts in this organizational directory only (Default Directory only - Single tenant)"
Click "Register"

Steps to add role to the application

Navigate to Roles and Administrators page:
Azure portal -> Azure Active Directory -> Roles and administrators
Search for Helpdesk Administrator role and click on it
Click on + Add assignments
Search for the application that was created above, select it, and click on "Add"

Create App Secret

Navigate to Certificates & Secrets:
Azure portal -> Azure Active Directory -> App Registrations -> Select app that was created above -> Certificates & secrets
Under "Client secrets" click on + New client secret
Give description to a secret and click "Add"
Make sure to copy "Value" of the secret

Prepare Records for Rotation

Create a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'Login' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

See the Troubleshooting section for more information on legacy vs typed records

Populate the 'Login' field of the Keeper record with the Azure login name

Add Required Fields

The following fields are required for Azure AD rotation. Create each field with the label indicated and supply the required information.

For an easier time creating new Azure rotation records, create a custom record type with theses text type fields defined

Additional Rotation Settings

The following values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.

Rotate

To rotate Azure passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

rotate "My Azure Credentials" --plugin azureadpwd

The plugin can be supplied to the command as shown here, or added to a record field (see options above). Adding the plugin type to the record makes it possible to rotate several records at once with different plugins.

Output

After rotation is completed, the new password will be stored in the Password field of the record

Azure Plugin

Rotate Azure AD account passwords

Keeper has launched a new Password Rotation feature with Keeper Secrets Manager. This new capability is recommended for all password rotation use cases. The Documentation is linked below:

Password Rotation with Keeper Secrets Manager

This plugin generates/rotates Azure AD password for any user.

Prerequisites

Install Microsoft Authentication Library (MSAL) for Python

pip install msal

Configure Azure Application to have User Administrative Privileges

Configure Azure Application for Rotation

Follow these steps as one-time setup for Azure rotation

Steps to register new application

Navigate to new app registration page:
Azure portal -> Azure Active Directory -> App Registrations -> New Registration
Give a name to the application and leave Supported account type as "Accounts in this organizational directory only (Default Directory only - Single tenant)"
Click "Register"

Steps to add role to the application

Navigate to Roles and Administrators page:
Azure portal -> Azure Active Directory -> Roles and administrators
Search for Helpdesk Administrator role and click on it
Click on + Add assignments
Search for the application that was created above, select it, and click on "Add"

Create App Secret

Navigate to Certificates & Secrets:
Azure portal -> Azure Active Directory -> App Registrations -> Select app that was created above -> Certificates & secrets
Under "Client secrets" click on + New client secret
Give description to a secret and click "Add"
Make sure to copy "Value" of the secret

Prepare Records for Rotation

Create a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'Login' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

See the Troubleshooting section for more information on legacy vs typed records

Populate the 'Login' field of the Keeper record with the Azure login name

Add Required Fields

The following fields are required for Azure AD rotation. Create each field with the label indicated and supply the required information.

Label

Description

For an easier time creating new Azure rotation records, create a custom record type with theses text type fields defined

Additional Rotation Settings

The following values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.

Label

Value

Description

Rotate

To rotate Azure passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

rotate "My Azure Credentials" --plugin azureadpwd

Output

After rotation is completed, the new password will be stored in the Password field of the record

Azure Plugin

Prerequisites

Install Microsoft Authentication Library (MSAL) for Python

Configure Azure Application to have User Administrative Privileges

Steps to register new application

Steps to add role to the application

Create App Secret

Prepare Records for Rotation

Create a Record for Rotation

Set the Azure Login Name

Add Required Fields

Additional Rotation Settings

Rotate

Output

Azure Plugin

Prerequisites

Install Microsoft Authentication Library (MSAL) for Python

Configure Azure Application to have User Administrative Privileges

Steps to register new application

Steps to add role to the application

Create App Secret

Prepare Records for Rotation

Create a Record for Rotation

Set the Azure Login Name

Add Required Fields

Additional Rotation Settings

Rotate

Output