Azure
Password Rotation in the Azure Environment
Overview
In this section, you will learn how to rotate user credentials within the Azure network environment across various target systems. Rotation works on the devices configured and attached to Microsoft Entra ID, which can also be your default directory.
KeeperPAM can rotate the password for Microsoft Entra ID users, service accounts, local admin users, local users, managed services, databases and more.
KeeperPAM Record Types
Configurations for Microsoft Entra ID are defined in the PAM Configuration section of Keeper Secrets Manager.
Configurations for the Microsoft Entra ID joined devices are defined in the PAM Directory, PAM Machine, and PAM Database record types. The credentials and user accounts are defined in PAM User records. The following table shows the supported Microsoft Entra ID joined devices with Keeper Rotation and their corresponding PAM Record Type:
Microsoft Entra Domain Services
PAM Directory
Virtual Machines
PAM Machine
Managed Databases
PAM Database
Prerequisites for Rotation
Prior to rotating user credentials within your Azure environment, you need to make sure you have the following information and configurations in place:
All Microsoft Entra ID joined devices that you want to use with Rotation need to be created and configured within your Microsoft Entra ID
To successfully configure and setup Rotation within your Azure Network, the following values are needed for your PAM Configuration:
Client ID
The application/client id (UUID) of the Azure application
Client Secret
The client credentials secret for the Azure application
Subscription ID
The UUID of your subscription to use Azure services (i.e. Pay-As-You-GO)
Tenant ID
The UUID of the Microsoft Entra ID
Make sure all the Azure services or Microsoft Entra ID joined devices you plan on using for rotation have access to Microsoft Entra ID.
Create a custom role to allow application to access/perform actions on various Azure resources. For more information see the Azure Environment Setup document.
Setup Steps
At a high level, the following steps are needed to successfully rotate passwords on your Azure network:
Create Shared Folders to hold the PAM records involved in rotation
Create PAM Machine, PAM Database and PAM Directory records representing each resource
Create PAM User records that contain the necessary account credentials for each resource
Link the PAM User record to the PAM Resource record.
Assign a Secrets Manager Application to all of the shared folders that hold the PAM records
Install a Keeper Gateway and add it to the Secrets Manager application
Create a PAM Configuration with the Azure environment setting
Configure Rotation settings on the PAM User records
Use Cases:
Last updated