---
schema_version: "1"
id: 2096e2c1c3e20536783fcf73bff11932fddfae00ac1593c4eda946f91a9a40e3
title: Azure Key Vault Properties Provider 2.2 Reference
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/azure-key-vault-properties-provider-connector/latest/azure-key-vault-properties-provider-reference.md
canonical_url: https://docs.mulesoft.com/azure-key-vault-properties-provider-connector/latest/azure-key-vault-properties-provider-reference
source_site: docs.mulesoft.com
content_type: documentation
content_hash: e38c54b40ee56e4b2f585525aafde9ab0ad2ae4b07e8dd88c7580033ed1da51a
description: MuleSoft Documentation Site
release: "2.2"
latest: true
---
---
product: Azure Key Vault Properties Provider
version: 2.2
is-latest-version: true
---

# Azure Key Vault Properties Provider 2.2 Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Azure Key Vault Properties Provider is a configuration that enables you to retrieve your secrets
from a secure Azure cloud service before your Mule app runs.

## Configuration

Default Configuration for Azure Key Vault Properties Provider.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name for this configuration. Connectors reference the configuration with this name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Client Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Client ID of your app. If not set, the properties provider uses the Azure SDK default authentication and looks for this value in the environment variable <code>AZURE_CLIENT_ID</code>. Note: <code>tenantId</code>, <code>clientId</code>, and <code>clientSecret</code> must be set together if specified in the configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Tenant Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Tenant ID of your app. If not set, the properties provider uses the Azure SDK default authentication and looks for this value in the environment variable <code>AZURE_TENANT_ID</code>. Note: <code>tenantId</code>, <code>clientId</code>, and <code>clientSecret</code> must be set together if specified in the configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Client Secret</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Client secret of your app. If not set, the properties provider uses the Azure SDK default authentication and looks for this value in the environment variable <code>AZURE_CLIENT_SECRET</code>. Note: <code>tenantId</code>, <code>clientId</code>, and <code>clientSecret</code> must be set together if specified in the configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Key Vault Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the vault to connect. If not set, the properties provider uses the system property <code>MULE_AZURE_KEY_VAULT_NAME</code>.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Uri Override</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The URI override for the key vault.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

## Requirements

Add the following repository and its associated credentials in the Maven settings:

```xml
<repository>
          <id>MuleRepository2</id>
          <name>MuleRepository2</name>
          <url>https://repository.mulesoft.org/nexus/content/repositories/releases-ee/</url>
          <layout>default</layout>
          <releases>
            <enabled>true</enabled>
          </releases>
          <snapshots>
            <enabled>true</enabled>
          </snapshots>
</repository>
```

## Limitations

Azure Key Vault Properties Provider doesn’t support the use of property files for the configuration
of the properties provider.

## Environment Variables

Use the following environment variables to configure the behavior of the Azure Key Vault Properties
Provider from the environment instead of specifying parameters in the Mule app configuration:

- `AZURE_CLIENT_ID`

- `AZURE_CLIENT_SECRET`

- `AZURE_TENANT_ID`

- `MULE_AZURE_KEY_VAULT_NAME`

These variables are stored in secure configuration files with the values encrypted. During
execution, the runtime decrypts these values and they remain in memory in their decrypted state. For
more information, refer to [Protecting App Property Values](https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props).

### Authenticate Through Environment Variables

To authenticate to Azure Key Vault using environment variables, set the following environment
variables:

- `AZURE_CLIENT_ID`

- `AZURE_CLIENT_SECRET`

- `AZURE_TENANT_ID`

Refer to [Setting Environment Variables](https://docs.mulesoft.com/mule-runtime/latest/setting-environment-variables)
for details.

If you do not set the `tenantId`, `clientId`, or `clientSecret` attributes in the configuration, the
properties provider uses the values from the environment variables.

In the XML configuration, you can omit the attributes if you use environment variables:

```xml
<!-- Configuration using environment variables for tenantId, clientId and clientSecret -->
<azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
    keyVaultName="connectors-vault"/>
```

### Configure Key Vault Name Through Environment Variables

If you do not set the `keyVaultName` attribute, the properties provider uses the system property
`MULE_AZURE_KEY_VAULT_NAME`:

```xml
<!-- Configuration using environment variables for tenantId, clientId, clientSecret, and keyVaultName -->
<azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"/>
```

If neither is set, the properties providers throws a `RuntimeException` message.

## Configure Multiple Key Vaults

Starting in version 2.2.0, you can define more than one Azure Key Vault Properties Provider
configuration in the same Mule app, with each configuration connecting to a different key vault.
Each configuration is isolated by its own namespace, which prevents conflicts when resolving secrets
and ensures that each secret is retrieved from the intended vault.

To reference a secret from a specific vault, use the configuration name as a namespace in the
following format:

```text
${azure-key-vault-properties-provider::configName::secret::yourSecret}
```

In this format, `configName` is the value of the `name` attribute of the properties provider
configuration, and `yourSecret` is the name of the secret to retrieve.

The following example defines two configurations, each connecting to a different key vault:

```xml
<!-- Configuration for the first key vault -->
<azure-key-vault-properties-provider:config name="Vault_A"
    keyVaultName="vault-alpha"/>

<!-- Configuration for the second key vault -->
<azure-key-vault-properties-provider:config name="Vault_B"
    keyVaultName="vault-beta"/>
```

> [!NOTE] If you omit the `keyVaultName` attribute from a configuration, the properties provider
> falls back to the system property `MULE_AZURE_KEY_VAULT_NAME`. If multiple configurations in the
> same Mule app omit `keyVaultName`, they all fall back to the same system property value and
> therefore resolve to the same key vault. To connect each configuration to a different vault, set
> the `keyVaultName` attribute explicitly on each configuration.

To retrieve a secret from each vault, reference the secret through the corresponding configuration
name:

```xml
<!-- Retrieve a secret from vault-alpha through the Vault_A configuration -->
<set-variable variableName="prodSecret"
    value="${azure-key-vault-properties-provider::Vault_A::secret::production-db-password}"/>

<!-- Retrieve a secret from vault-beta through the Vault_B configuration -->
<set-variable variableName="stagingSecret"
    value="${azure-key-vault-properties-provider::Vault_B::secret::staging-api-key}"/>
```

### Legacy Secret Format

The legacy secret format `${azure-key-vault-properties-provider::secret::yourSecret}` is supported
only when the Mule app contains only one Azure Key Vault Properties Provider configuration.

If your Mule app uses a single configuration and relies on the legacy format, no changes are
required. To use multiple configurations, reference each secret through its configuration name using
the `${azure-key-vault-properties-provider::configName::secret::yourSecret}` format.

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)