# mulesoft Azure Key Vault Properties Provider - Full Documentation

<!-- document id=6cb395c64272ad990ee73861c433149d8dcac2828b57441524579cb6e0671558 url=/mulesoft/current/en-us/azure-key-vault-properties-provider-connector/2.1/index.md -->

---
product: Azure Key Vault Properties Provider
version: 2.1
---

# Azure Key Vault Properties Provider 2.1

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Azure Key Vault Properties Provider is a configuration that enables you to retrieve your secrets
from a secure Azure cloud service before your Mule app runs.

For information about compatibility and fixed issues, refer to the Azure Key Vault Properties
Provider Release Notes.

## Before You Begin

To use this properties provider, you must be familiar with:

- The Azure Key Vault API

- Anypoint Connectors

- Mule runtime engine (Mule)

- Elements and global elements in a Mule flow

- How to create a Mule app using Anypoint Studio

Before creating an app, you must have:

- Mule Enterprise Edition

- Credentials to access the Azure Key Vault target resource

- Anypoint Platform

- Anypoint Studio or Anypoint Code Builder

## Common Use Cases for the Properties Provider

With Azure Key Vault Properties Provider, secrets can be retrieved in the pre-runtime phase, which
means secrets are populated before the Mule app is deployed.

## Connection Types

Connectors can use the Azure Key Vault Properties Provider in their configuration. In the
configuration, use the `${azure-key-vault-properties-provider::secret::yourSecret}` structure to
retrieve a secret from Azure Key Vault. Here is an example:

![Example of a connector using Azure Key Vault Properties Provider in configuration window](/mulesoft/current/en-us/azure-key-vault-properties-provider-connector/2.1/_images/properties-provider-example.png)

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Use Exchange to Discover Connectors, Templates, and Examples](https://docs.mulesoft.com/connectors/introduction/intro-use-exchange)

- [Azure Key Vault Properties Provider Reference](https://docs.mulesoft.com/azure-key-vault-properties-provider-connector/2.1/azure-key-vault-properties-provider-reference)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=f0faaf28fac9d6b12e95948dc14a79a00e3f49d4c7db4aa3b15afffbd0edf35d url=/mulesoft/current/en-us/azure-key-vault-properties-provider-connector/2.1/azure-key-vault-properties-provider-reference.md -->

---
product: Azure Key Vault Properties Provider
version: 2.1
---

# Azure Key Vault Properties Provider 2.1 Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Azure Key Vault Properties Provider is a configuration that enables you to retrieve your secrets
from a secure Azure cloud service before your Mule app runs.

## Configuration

Default Configuration for Azure Key Vault Properties Provider.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name for this configuration. Connectors reference the configuration with this name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Client Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Client ID of your app. If not set, the properties provider uses the Azure SDK default authentication and looks for this value in the environment variable <code>AZURE_CLIENT_ID</code>. Note: <code>tenantId</code>, <code>clientId</code>, and <code>clientSecret</code> must be set together if specified in the configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Tenant Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Tenant ID of your app. If not set, the properties provider uses the Azure SDK default authentication and looks for this value in the environment variable <code>AZURE_TENANT_ID</code>. Note: <code>tenantId</code>, <code>clientId</code>, and <code>clientSecret</code> must be set together if specified in the configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Client Secret</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Client secret of your app. If not set, the properties provider uses the Azure SDK default authentication and looks for this value in the environment variable <code>AZURE_CLIENT_SECRET</code>. Note: <code>tenantId</code>, <code>clientId</code>, and <code>clientSecret</code> must be set together if specified in the configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Key Vault Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the vault to connect. If not set, the properties provider uses the system property <code>MULE_AZURE_KEY_VAULT_NAME</code>.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Uri Override</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The URI override for the key vault.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

## Requirements

Add the following repository and its associated credentials in the Maven settings:

```xml
<repository>
          <id>MuleRepository2</id>
          <name>MuleRepository2</name>
          <url>https://repository.mulesoft.org/nexus/content/repositories/releases-ee/</url>
          <layout>default</layout>
          <releases>
            <enabled>true</enabled>
          </releases>
          <snapshots>
            <enabled>true</enabled>
          </snapshots>
</repository>
```

## Limitations

Azure Key Vault Properties Provider doesn’t support the use of property files for the configuration
of the properties provider.

## Environment Variables

Use the following environment variables to configure the behavior of the Azure Key Vault Properties
Provider from the environment instead of specifying parameters in the Mule app configuration:

- `AZURE_CLIENT_ID`

- `AZURE_CLIENT_SECRET`

- `AZURE_TENANT_ID`

- `MULE_AZURE_KEY_VAULT_NAME`

These variables are stored in secure configuration files with the values encrypted. During
execution, the runtime decrypts these values and they remain in memory in their decrypted state. For
more information, refer to [Protecting App Property Values](https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props).

### Authenticate Through Environment Variables

To authenticate to Azure Key Vault using environment variables, set the following environment
variables:

- `AZURE_CLIENT_ID`

- `AZURE_CLIENT_SECRET`

- `AZURE_TENANT_ID`

Refer to [Setting Environment Variables](https://docs.mulesoft.com/mule-runtime/latest/setting-environment-variables)
for details.

If you do not set the `tenantId`, `clientId`, or `clientSecret` attributes in the configuration, the
properties provider uses the values from the environment variables.

In the XML configuration, you can omit the attributes if you use environment variables:

```xml
<!-- Configuration using environment variables for tenantId, clientId and clientSecret -->
<azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
    keyVaultName="connectors-vault"/>
```

### Configure Key Vault Name Through Environment Variables

If you do not set the `keyVaultName` attribute, the properties provider uses the system property
`MULE_AZURE_KEY_VAULT_NAME`:

```xml
<!-- Configuration using environment variables for tenantId, clientId, clientSecret, and keyVaultName -->
<azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"/>
```

If neither is set, the properties providers throws a `RuntimeException` message.

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=1cad0d01c6bb383d540be2e2681fec917f56dbbf176fc3b474c5ba11920bc980 url=/mulesoft/current/en-us/azure-key-vault-properties-provider-connector/latest/index.md -->

---
product: Azure Key Vault Properties Provider
version: 2.2
is-latest-version: true
---

# Azure Key Vault Properties Provider 2.2

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Azure Key Vault Properties Provider is a configuration that enables you to retrieve your secrets
from a secure Azure cloud service before your Mule app runs.

For information about compatibility and fixed issues, refer to the Azure Key Vault Properties
Provider Release Notes.

## Before You Begin

To use this properties provider, you must be familiar with:

- The Azure Key Vault API

- Anypoint Connectors

- Mule runtime engine (Mule)

- Elements and global elements in a Mule flow

- How to create a Mule app using Anypoint Studio

Before creating an app, you must have:

- Mule Enterprise Edition

- Credentials to access the Azure Key Vault target resource

- Anypoint Platform

- Anypoint Studio or Anypoint Code Builder

## Common Use Cases for the Properties Provider

With Azure Key Vault Properties Provider, secrets can be retrieved in the pre-runtime phase, which
means secrets are populated before the Mule app is deployed.

## Connection Types

Connectors can use the Azure Key Vault Properties Provider in their configuration. In the
configuration, use the `${azure-key-vault-properties-provider::secret::yourSecret}` structure to
retrieve a secret from Azure Key Vault. Here is an example:

![Example of a connector using Azure Key Vault Properties Provider in configuration window](/mulesoft/current/en-us/azure-key-vault-properties-provider-connector/latest/_images/properties-provider-example.png)

> [!NOTE] This example shows the legacy secret format
> `${azure-key-vault-properties-provider::secret::yourSecret}`, which applies to a single properties
> provider configuration. If your Mule app defines multiple configurations, use the namespaced
> format `${azure-key-vault-properties-provider::configName::secret::yourSecret}` instead.

Starting in version 2.2.0, you can define more than one Azure Key Vault Properties Provider
configuration in the same Mule app, with each configuration connecting to a different key vault. To
retrieve a secret from a specific vault, reference the secret using the configuration name as a
namespace, in the format `${azure-key-vault-properties-provider::configName::secret::yourSecret}`,
where `configName` is the value of the `name` attribute of the properties provider configuration.
For more information, refer to
[Azure Key Vault Properties Provider Reference](https://docs.mulesoft.com/azure-key-vault-properties-provider-connector/latest/azure-key-vault-properties-provider-reference).

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Use Exchange to Discover Connectors, Templates, and Examples](https://docs.mulesoft.com/connectors/introduction/intro-use-exchange)

- [Azure Key Vault Properties Provider Reference](https://docs.mulesoft.com/azure-key-vault-properties-provider-connector/latest/azure-key-vault-properties-provider-reference)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=2096e2c1c3e20536783fcf73bff11932fddfae00ac1593c4eda946f91a9a40e3 url=/mulesoft/current/en-us/azure-key-vault-properties-provider-connector/latest/azure-key-vault-properties-provider-reference.md -->

---
product: Azure Key Vault Properties Provider
version: 2.2
is-latest-version: true
---

# Azure Key Vault Properties Provider 2.2 Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Azure Key Vault Properties Provider is a configuration that enables you to retrieve your secrets
from a secure Azure cloud service before your Mule app runs.

## Configuration

Default Configuration for Azure Key Vault Properties Provider.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name for this configuration. Connectors reference the configuration with this name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Client Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Client ID of your app. If not set, the properties provider uses the Azure SDK default authentication and looks for this value in the environment variable <code>AZURE_CLIENT_ID</code>. Note: <code>tenantId</code>, <code>clientId</code>, and <code>clientSecret</code> must be set together if specified in the configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Tenant Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Tenant ID of your app. If not set, the properties provider uses the Azure SDK default authentication and looks for this value in the environment variable <code>AZURE_TENANT_ID</code>. Note: <code>tenantId</code>, <code>clientId</code>, and <code>clientSecret</code> must be set together if specified in the configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Client Secret</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Client secret of your app. If not set, the properties provider uses the Azure SDK default authentication and looks for this value in the environment variable <code>AZURE_CLIENT_SECRET</code>. Note: <code>tenantId</code>, <code>clientId</code>, and <code>clientSecret</code> must be set together if specified in the configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Key Vault Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the vault to connect. If not set, the properties provider uses the system property <code>MULE_AZURE_KEY_VAULT_NAME</code>.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Uri Override</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The URI override for the key vault.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

## Requirements

Add the following repository and its associated credentials in the Maven settings:

```xml
<repository>
          <id>MuleRepository2</id>
          <name>MuleRepository2</name>
          <url>https://repository.mulesoft.org/nexus/content/repositories/releases-ee/</url>
          <layout>default</layout>
          <releases>
            <enabled>true</enabled>
          </releases>
          <snapshots>
            <enabled>true</enabled>
          </snapshots>
</repository>
```

## Limitations

Azure Key Vault Properties Provider doesn’t support the use of property files for the configuration
of the properties provider.

## Environment Variables

Use the following environment variables to configure the behavior of the Azure Key Vault Properties
Provider from the environment instead of specifying parameters in the Mule app configuration:

- `AZURE_CLIENT_ID`

- `AZURE_CLIENT_SECRET`

- `AZURE_TENANT_ID`

- `MULE_AZURE_KEY_VAULT_NAME`

These variables are stored in secure configuration files with the values encrypted. During
execution, the runtime decrypts these values and they remain in memory in their decrypted state. For
more information, refer to [Protecting App Property Values](https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props).

### Authenticate Through Environment Variables

To authenticate to Azure Key Vault using environment variables, set the following environment
variables:

- `AZURE_CLIENT_ID`

- `AZURE_CLIENT_SECRET`

- `AZURE_TENANT_ID`

Refer to [Setting Environment Variables](https://docs.mulesoft.com/mule-runtime/latest/setting-environment-variables)
for details.

If you do not set the `tenantId`, `clientId`, or `clientSecret` attributes in the configuration, the
properties provider uses the values from the environment variables.

In the XML configuration, you can omit the attributes if you use environment variables:

```xml
<!-- Configuration using environment variables for tenantId, clientId and clientSecret -->
<azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
    keyVaultName="connectors-vault"/>
```

### Configure Key Vault Name Through Environment Variables

If you do not set the `keyVaultName` attribute, the properties provider uses the system property
`MULE_AZURE_KEY_VAULT_NAME`:

```xml
<!-- Configuration using environment variables for tenantId, clientId, clientSecret, and keyVaultName -->
<azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"/>
```

If neither is set, the properties providers throws a `RuntimeException` message.

## Configure Multiple Key Vaults

Starting in version 2.2.0, you can define more than one Azure Key Vault Properties Provider
configuration in the same Mule app, with each configuration connecting to a different key vault.
Each configuration is isolated by its own namespace, which prevents conflicts when resolving secrets
and ensures that each secret is retrieved from the intended vault.

To reference a secret from a specific vault, use the configuration name as a namespace in the
following format:

```text
${azure-key-vault-properties-provider::configName::secret::yourSecret}
```

In this format, `configName` is the value of the `name` attribute of the properties provider
configuration, and `yourSecret` is the name of the secret to retrieve.

The following example defines two configurations, each connecting to a different key vault:

```xml
<!-- Configuration for the first key vault -->
<azure-key-vault-properties-provider:config name="Vault_A"
    keyVaultName="vault-alpha"/>

<!-- Configuration for the second key vault -->
<azure-key-vault-properties-provider:config name="Vault_B"
    keyVaultName="vault-beta"/>
```

> [!NOTE] If you omit the `keyVaultName` attribute from a configuration, the properties provider
> falls back to the system property `MULE_AZURE_KEY_VAULT_NAME`. If multiple configurations in the
> same Mule app omit `keyVaultName`, they all fall back to the same system property value and
> therefore resolve to the same key vault. To connect each configuration to a different vault, set
> the `keyVaultName` attribute explicitly on each configuration.

To retrieve a secret from each vault, reference the secret through the corresponding configuration
name:

```xml
<!-- Retrieve a secret from vault-alpha through the Vault_A configuration -->
<set-variable variableName="prodSecret"
    value="${azure-key-vault-properties-provider::Vault_A::secret::production-db-password}"/>

<!-- Retrieve a secret from vault-beta through the Vault_B configuration -->
<set-variable variableName="stagingSecret"
    value="${azure-key-vault-properties-provider::Vault_B::secret::staging-api-key}"/>
```

### Legacy Secret Format

The legacy secret format `${azure-key-vault-properties-provider::secret::yourSecret}` is supported
only when the Mule app contains only one Azure Key Vault Properties Provider configuration.

If your Mule app uses a single configuration and relies on the legacy format, no changes are
required. To use multiple configurations, reference each secret through its configuration name using
the `${azure-key-vault-properties-provider::configName::secret::yourSecret}` format.

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=0909d5a703c22f23b0c6f1061b7db44700a1db59f8a731a3ab4913743f9dfefd url=/mulesoft/current/en-us/azure-key-vault-properties-provider-connector/2.1/azure-key-vault-properties-provider-upgrade-guide.md -->

---
product: Azure Key Vault Properties Provider
version: 2.1
---

# Upgrading and Migrating Azure Key Vault Properties Provider to Version 2.1

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Upgrade Azure Key Vault Properties Provider to version 2.1.0.

## Supported Upgrade Paths

<table><colgroup><col> <col></colgroup><thead><tr><th>From Version</th><th>To Version</th></tr></thead><tbody><tr><td><div><div><p>1.0.1</p></div></div></td><td><div><div><p>2.1.0</p></div></div></td></tr></tbody></table>

## Changes in This Release

This release contains the following changes:

- Added **Uri Override** field to specify the URI for a key vault located outside Azure Commercial
  Cloud.

- Azure Key Vault Properties Provider now supports Azure Default Credential. You can specify your
  authentication credentials via environment variables.

- The `tenantId`, `clientId`, and `clientSecret` attributes are now optional. You must specify these
  attributes together; otherwise, the properties provider uses the values from the environment
  variables.

- The properties provider changed its internal package name.

- The `Key Vault Name` attribute is now optional and you can set it through the system property
  `MULE_AZURE_KEY_VAULT_NAME`.

## Upgrade Prerequisites

To perform the upgrade:

- Create a backup of your files, data, and configurations in case you need to restore to them.

## Upgrade Steps

Follow these steps to perform the upgrade:

1.  In Anypoint Studio, create a Mule project.

2.  In **Mule Palette**, click **Search in Exchange**.

3.  In **Add Dependencies to Project**, enter `azure key vault properties provider` in the search
    field.

4.  In **Available modules**, select **Azure Key Vault Properties Provider** and click **Add**.

5.  Click **Finish**.

6.  Verify that the Azure Key Vault Properties Provider `mule4-azure-key-vault-properties-provider`
    version is 2.1.0 in the `pom.xml` file in the Mule project.

## Verify the Upgrade

After you install the latest version of the properties provider, verify the upgrade:

1.  In Studio, verify that there are no errors in the **Problems** or **Console** views.

2.  Verify that there are no problems in the project `pom.xml` file.

3.  Test the connection to verify that the operations work.

4.  Ensure that the `Key Vault Name` is correctly configured either in the configuration file or as
    the system property `MULE_AZURE_KEY_VAULT_NAME`.

5.  If using environment variables for `tenantId`, `clientId`, and `clientSecret`, ensure these are
    set correctly and verify their usage.

## Update Configuration Files

If your project configuration files (XML) specify the `Key Vault Name`, update them as follows:

- If the `keyVaultName` attribute is not needed, you can remove it and use the system property
  `MULE_AZURE_KEY_VAULT_NAME` instead.

- Ensure that `tenantId`, `clientId`, and `clientSecret` are correctly set, either as attributes in
  the configuration file or as environment variables (`AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`,
  `AZURE_TENANT_ID`).

### Example Configuration

If you prefer to use environment variables, your configuration looks like this:

```xml
<azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config" />
```

Alternatively, use the attributes directly in the configuration:

```xml
<azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
    keyVaultName="connectors-vault"
    tenantId="your-tenant-id"
    clientId="your-client-id"
    clientSecret="your-client-secret"/>
```

## Revert the Upgrade

If you need to revert to the previous version of Azure Key Vault Properties Provider, follow these
steps:

1.  Go to Anypoint Studio.

2.  In the project’s `pom.xml` file, change the `mule4-azure-key-vault-properties-provider`
    dependency version from 2.1.0 to the previous version.

After reverting, you must review and adapt your configurations to be compatible with the previous
version:

### Revert to Version 2.0.0:

Ensure that the `keyVaultName` attribute is explicitly set in your configuration files, as version
2.0.0 does not support the system property `MULE_AZURE_KEY_VAULT_NAME`.

Example Configuration for Version 2.0.0:

```xml
  <azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
      keyVaultName="connectors-vault"
      tenantId=""
      clientId=""
      clientSecret=""/>
```

### Revert to a Major Previous Version (e.g., 1.0.1):

Ensure that the `keyVaultName`, `tenantId`, `clientId`, and `clientSecret` attributes are explicitly
set in your configuration files, as these versions do not support setting these values through
system properties or environment variables.

Example Configuration for Version 1.0.1:

```xml
  <azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
     keyVaultName="connectors-vault"
     tenantId="your-tenant-id"
     clientId="your-client-id"
     clientSecret="your-client-secret"/>
```

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=3368428a64a0cea803f61d55b8967851e0fda5ea051e5e24375001768d9426a7 url=/mulesoft/current/en-us/azure-key-vault-properties-provider-connector/latest/azure-key-vault-properties-provider-upgrade-guide.md -->

---
product: Azure Key Vault Properties Provider
version: 2.2
is-latest-version: true
---

# Upgrading and Migrating Azure Key Vault Properties Provider to Version 2.2

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Upgrade Azure Key Vault Properties Provider to version 2.2.0.

## Supported Upgrade Paths

<table><colgroup><col> <col></colgroup><thead><tr><th>From Version</th><th>To Version</th></tr></thead><tbody><tr><td><div><div><p>2.1.x</p></div></div></td><td><div><div><p>2.2.0</p></div></div></td></tr></tbody></table>

## Changes in This Release

This release contains the following changes:

- Azure Key Vault Properties Provider now supports multiple key vault configurations in the same
  Mule app. Each configuration connects to a different key vault, and you reference secrets by using
  the configuration name as a namespace, in the format
  `${azure-key-vault-properties-provider::configName::secret::yourSecret}`.

- The legacy secret format `${azure-key-vault-properties-provider::secret::yourSecret}` is now
  supported only when the Mule app contains a single properties provider configuration.

> [!IMPORTANT] If your existing configuration has multiple configs defined and references secrets
> through the legacy `${azure-key-vault-properties-provider::secret::yourSecret}` format, you must
> update those references to use the
> `${azure-key-vault-properties-provider::configName::secret::yourSecret}` format after upgrading.
> For the migration steps, refer to [Update Configuration Files](#update-configuration-files).

## Upgrade Prerequisites

To perform the upgrade:

- Create a backup of your files, data, and configurations in case you need to restore to them.

## Upgrade Steps

Follow these steps to perform the upgrade:

1.  In Anypoint Studio, create a Mule project.

2.  In **Mule Palette**, click **Search in Exchange**.

3.  In **Add Dependencies to Project**, enter `azure key vault properties provider` in the search
    field.

4.  In **Available modules**, select **Azure Key Vault Properties Provider** and click **Add**.

5.  Click **Finish**.

6.  Verify that the Azure Key Vault Properties Provider `mule4-azure-key-vault-properties-provider`
    version is 2.2.0 in the `pom.xml` file in the Mule project.

## Verify the Upgrade

After you install the latest version of the properties provider, verify the upgrade:

1.  In Studio, verify that there are no errors in the **Problems** or **Console** views.

2.  Verify that there are no problems in the project `pom.xml` file.

3.  Test the connection to verify that the operations work.

4.  Ensure that the `Key Vault Name` is correctly configured for each configuration, either through
    the `keyVaultName` attribute or the system property `MULE_AZURE_KEY_VAULT_NAME`. If your Mule
    app uses multiple key vault configurations that must connect to different vaults, set the
    `keyVaultName` attribute explicitly on each configuration, because configurations that omit
    `keyVaultName` all fall back to the same system property value and therefore resolve to the same
    vault.

5.  If using environment variables for `tenantId`, `clientId`, and `clientSecret`, ensure these are
    set correctly and verify their usage.

## Update Configuration Files

If your project configuration files (XML) reference secrets through the legacy
`${azure-key-vault-properties-provider::secret::yourSecret}` format and your Mule app uses multiple
key vault configurations, update the secret references to use the configuration name as a namespace:

- Before upgrading:

  ```xml
  <azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
      keyVaultName="connectors-vault"/>

  <set-variable variableName="dbPassword"
      value="${azure-key-vault-properties-provider::secret::mulesoft-test-password}"/>
  ```

- After upgrading:

  ```xml
  <azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
      keyVaultName="connectors-vault"/>

  <set-variable variableName="dbPassword"
      value="${azure-key-vault-properties-provider::configName::secret::yourSecret}"/>
  ```

If your Mule app uses a single configuration, the legacy secret format continues to work and no
changes are required.

If your project configuration files (XML) specify multiple Key Vault configurations, update them as
follows:

- If a configuration must resolve to the vault defined by the system property
  `MULE_AZURE_KEY_VAULT_NAME`, you can remove the `keyVaultName` attribute from that configuration.
  Note that all configurations that omit `keyVaultName` fall back to the same system property value
  and therefore resolve to the same vault, so set the `keyVaultName` attribute explicitly on each
  configuration that must connect to a different vault.

- Ensure that `tenantId`, `clientId`, and `clientSecret` are correctly set, either as attributes in
  the configuration file or as environment variables (`AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`,
  `AZURE_TENANT_ID`).

### Example Configuration

If you prefer to use environment variables, your configuration looks like this:

```xml
<azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config" />
```

Alternatively, use the attributes directly in the configuration:

```xml
<azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
    keyVaultName="connectors-vault"
    tenantId="your-tenant-id"
    clientId="your-client-id"
    clientSecret="your-client-secret"/>
```

## Revert the Upgrade

If you need to revert to the previous version of Azure Key Vault Properties Provider, follow these
steps:

1.  Go to Anypoint Studio.

2.  In the project’s `pom.xml` file, change the `mule4-azure-key-vault-properties-provider`
    dependency version from 2.2.0 to the previous version.

After reverting, you must review and adapt your configurations to be compatible with the previous
version:

### Revert to Version 2.1.x:

If you use multiple key vault configurations or reference secrets through the
`${azure-key-vault-properties-provider::configName::secret::yourSecret}` format, revert your secret
references to the legacy `${azure-key-vault-properties-provider::secret::yourSecret}` format,
because versions earlier than 2.2.0 do not support configuration-name namespacing. These versions
support only a single key vault configuration.

### Revert to Version 2.0.0:

Ensure that the `keyVaultName` attribute is explicitly set in your configuration files, as version
2.0.0 does not support the system property `MULE_AZURE_KEY_VAULT_NAME`.

Example Configuration for Version 2.0.0:

```xml
  <azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
      keyVaultName="connectors-vault"
      tenantId=""
      clientId=""
      clientSecret=""/>
```

### Revert to a Major Previous Version (e.g., 1.0.1):

Ensure that the `keyVaultName`, `tenantId`, `clientId`, and `clientSecret` attributes are explicitly
set in your configuration files, as these versions do not support setting these values through
system properties or environment variables.

Example Configuration for Version 1.0.1:

```xml
  <azure-key-vault-properties-provider:config name="Azure_Key_Vault_Properties_Provider_Config"
     keyVaultName="connectors-vault"
     tenantId="your-tenant-id"
     clientId="your-client-id"
     clientSecret="your-client-secret"/>
```

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)