# Azure Plugin

{% hint style="warning" %}
Keeper has also launched a zero-trust Password Rotation feature with KeeperPAM. This new capability is recommended for most password rotation use cases. The Documentation is linked below:

* [Password Rotation with KeeperPAM](/keeperpam/secrets-manager/password-rotation.md)
* Commander [KeeperPAM commands](/keeperpam/commander-cli/command-reference/keeperpam-commands.md)
  {% endhint %}

This plugin generates/rotates Azure AD password for any user.

## Prerequisites

#### Install [Microsoft Authentication Library (MSAL) for Python](https://github.com/AzureAD/microsoft-authentication-library-for-python)

```
pip install msal
```

#### Configure Azure Application to have User Administrative Privileges

<details>

<summary>Configure Azure Application for Rotation</summary>

Follow these steps as one-time setup for Azure rotation

**Steps to register new application**

1. Navigate to new app registration page:

   Azure portal -> `Azure Active Directory` -> `App Registrations` -> `New Registration`
2. Give a name to the application and leave Supported account type as "Accounts in this organizational directory only (Default Directory only - Single tenant)"
3. Click "Register"

**Steps to add role to the application**

1. Navigate to Roles and Administrators page:

   Azure portal -> `Azure Active Directory` -> `Roles and administrators`
2. Search for `Helpdesk Administrator` role and click on it
3. Click on `+ Add assignments`
4. Search for the application that was created above, select it, and click on "Add"

**Create App Secret**

1. Navigate to Certificates & Secrets:

   Azure portal -> `Azure Active Directory` -> `App Registrations` -> Select app that was created above -> `Certificates & secrets`
2. Under "Client secrets" click on `+ New client secret`
3. Give description to a secret and click "Add"
4. Make sure to copy "Value" of the secret

</details>

## Prepare Records for Rotation

### Create a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'Login' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

{% hint style="info" %}
See the [Troubleshooting ](/keeperpam/commander-cli/troubleshooting-commander-cli.md#typed-vs-untyped-records-v3-vs-v2)section for more information on legacy vs typed records
{% endhint %}

### Set the Azure Login Name

**Populate the 'Login' field of the Keeper record with the Azure login name**

![](https://762006384-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJXOXEifAmpyvNVL1to%2F-Mf3OKL0C-A5D2nQFew1%2F-Mf3_72XQ3z1I6frpa2m%2Fimage.png?alt=media\&token=a85def6d-1882-4e7a-a9e5-022cee7d6ec2)

### Add Required Fields

The following fields are required for Azure AD rotation. Create each field with the label indicated and supply the required information.

<table><thead><tr><th width="239.3990289312453">Label</th><th width="289.85093542546775">Description</th></tr></thead><tbody><tr><td>cmdr:azure_secret</td><td>Displayed upon Registration of a new application (under Azure portal -> <code>Azure Active Directory</code> -> <code>App Registrations</code> -> <code>New Registration</code>.</td></tr><tr><td>cmdr:azure_client_id</td><td>Azure portal -> <code>Azure Active Directory</code> -> <code>App Registrations</code> -> [App name] -> <code>Application (client) ID</code></td></tr><tr><td>cmdr:azure_tenant_id</td><td>Azure portal -> <code>Azure Active Directory</code> -> <code>App Registrations</code> -> [App name] -> <code>Directory (tenant) ID</code></td></tr><tr><td>cmdr:azure_cloud</td><td>Optional. Azure Cloud. There are 4 physical Azure cloud locations<br>1. <code>Global</code>. Default location. Omit this property.<br>2. <code>China</code><br><code>3. German</code><br><code>4. USGov</code></td></tr></tbody></table>

{% hint style="info" %}
For an easier time creating new Azure rotation records, create a custom record type with theses text type fields defined
{% endhint %}

#### Additional Rotation Settings

The following values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.

<table><thead><tr><th>Label</th><th width="150">Value</th><th width="289.85093542546775">Description</th></tr></thead><tbody><tr><td>cmdr:plugin</td><td>azureadpwd</td><td>(Optional) Tells Commander to use Azure AD Key rotation. This should be either set to the record, or supplied to the rotation command</td></tr><tr><td>cmdr:rules</td><td></td><td>(Optional) <a href="https://github.com/Keeper-Security/Commander/tree/master/keepercommander/plugins/password_rules.md">password complexity rules</a></td></tr></tbody></table>

## Rotate

To rotate Azure passwords, use the `rotate` command in Commander. Pass the command a record title or UID (or use `--match` with a regular expression to rotate several records at once)

```
rotate "My Azure Credentials" --plugin azureadpwd
```

{% hint style="info" %}
The plugin can be supplied to the command as shown here, or added to a record field (see options above).\
Adding the plugin type to the record makes it possible to rotate several records at once with different plugins.
{% endhint %}

#### Output

After rotation is completed, the new password will be stored in the `Password` field of the record


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/commander-cli/command-reference/plugins/azure-plugin.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.