Monitor Azure keyvault Key\Secret\Certificate Expiry

Prashanth Miryala 5 Reputation points Microsoft Vendor
2023-08-01T12:10:57.2033333+00:00

we are looking for a mechanism to alert on Keyvault Key\Secret\Certificate when it is nearby expiry without using any automation(runbook\Webhook)
is there any possibility?

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,126 questions
Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,811 questions
0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. David Broggy 5,681 Reputation points MVP
    2023-08-01T13:07:34.5566667+00:00

    Hi Prashanth,

    Take a look at this post, it mentions there are already built in methods for notification of expired keys.

    https://techcommunity.microsoft.com/t5/azure-infrastructure/keyvault-expiry-date-notification-automation/m-p/3662356

    Regards,

  2. JamesTran-MSFT 36,376 Reputation points Microsoft Employee
    2023-08-11T19:15:07.67+00:00

    @Prashanth Miryala

    Thank you for your post and I apologize for the delayed response!

    I understand that you're trying to create alerts based off a Certificate's expiration date without having to use any automation such as a runbook, webhook, etc. To hopefully help point you in the right direction or resolve your issue, I'll share my findings below.

    Findings:

    You can automate alerts without the need for additional automation resources (i.e. runbook/webhook) by adding certificate contact(s) to your Key Vault and configuring notifications for certificate life events.

    • Note: The contact's information is shared by all the certificates in the key vault and a notification is sent to all the specified contacts for an event for any certificate in the key vault.

    User's image

    Get notified about certificate expiration:

    • Note: For existing Certificates, you'll need to manually update the Issuance Policy from Automatic to Email.

    If a certificate's policy is set to auto renewal, then a notification is sent on the following events:

    • Before certificate renewal
    • After certificate renewal, stating if the certificate was successfully renewed, or if there was an error, requiring manual renewal of the certificate.

    When a certificate policy is set to be manually renewed (email only), a notification is sent when it's time to renew the certificate.

    User's image

    Additional Links:

    I hope this helps!

    If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

    If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

  3. Geetha O 1 Reputation point
    2023-10-26T13:46:18.84+00:00

    Hi Team,
    What is the privilege's required to create logic app in azure ?
    Iam getting error while creating connection with my id

    0 comments
  4. Renze Yu 26 Reputation points Microsoft Employee
    2024-04-24T02:06:35.1066667+00:00

    Certificates have an issuance policy, but secrets have not. If you want this on secrets, this blog post can work for it. I have not tried this from end to end, but I succeeded in query SecretNearExpiry operation in the log analytics workspace. This is promising: https://medium.com/version-1/azure-key-vault-secret-expiry-notifications-using-azure-alerts-e6930d3f135d

    0 comments