Key Vault Scan¶

The Scan reads all Azure Key Vaults across your subscriptions to inventory secrets, keys, and certificates with expiration tracking.

Overview¶

The Scan provides a centralised view of all vault contents across your Azure environment:

• Multi-subscription scanning: Scan all Key Vaults across multiple Azure subscriptions
• Complete inventory: Secrets, keys, and certificates with metadata
• Expiration tracking: Visual indicators for healthy, warning, and critical status
• Historical data: Track changes over time with scan history
• Quick scans: Skip vaults read recently, for speed on large estates
• TLS endpoints: The host names your Azure services serve over TLS and the certificate each one presents, including certificates that are not in Key Vault. See TLS Endpoints
• Enterprise Application monitoring: The rotation-discovery run inventories service-principal credentials and owners. See Enterprise Applications (monitor-only)

What Gets Scanned¶

Secrets¶

Keys¶

Certificates¶

Certificate renewal¶

The Renewal column on the Key Vaults sub-tab shows how each certificate renews, and you can filter the list by it:

On PRO, an admin can click Turn on auto-renew on a self-signed certificate that will not renew. Key Vault then renews it itself when 80% of its life has passed, even while CertifyClouds is switched off. The button is not offered on a certificate CertifyClouds rotates for an App Registration; see Certificate Rotation for why.

On PRO, Renew certificate on a certificate's page renews it now, whoever issued it. See Certificate Renewal.

A certificate's page also flags a weak signature (MD5 or SHA-1) and whether the intermediate certificates of a CA-issued certificate are in date.

Running a Scan¶

From the UI¶

1. Navigate to Assets → Scan. It has three sub-tabs: Key Vaults (vault contents), TLS Endpoints and History (past scans)
2. Click Run Scan. It reads every vault from Azure.
3. For a faster pass on a large estate, open the menu next to Run Scan and pick Quick scan instead. It skips any vault read within the scan cache lifetime (Settings → Advanced → Scan cache lifetime, 24 hours by default), so a change made in Azure since that vault was last read doesn't show until it is read again.
4. Monitor progress in real-time
5. View results when complete

Via API¶

# Start a full scan
curl -X POST http://localhost:8080/api/assets/discovery/scan \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"scanMode": "full"}'

# Start a quick scan (skips vaults read within the scan cache lifetime)
curl -X POST http://localhost:8080/api/assets/discovery/scan \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"scanMode": "delta"}'

Scan Modes¶

The API also accepts force, which behaves exactly like full.

Expiration Status¶

CertifyClouds categorises assets by expiration status:

Configuring Thresholds¶

Thresholds are configurable per alert rule:

1. Go to Settings > Alerts
2. Create or edit an expiring secrets rule
3. Set your preferred threshold (e.g., 14, 30, 60 days)

Scan Results¶

Dashboard View¶

The Assets dashboard shows:

• Total Assets: Count by type (secrets, keys, certificates)
• Expiration Distribution: Donut chart of healthy/warning/critical
• Recent Scans: History with duration and counts
• Vault List: All vaults with asset counts

Asset Details¶

Click any vault to see:

• Vault Properties: Name, location, resource group, SKU
• Access Configuration: RBAC vs Access Policies
• Network Settings: Public/private access, firewall rules
• Asset List: All secrets, keys, and certificates

Export Options¶

Export scan results in multiple formats:

• JSON: For automation and integration
• CSV: For spreadsheets and reporting
• PDF: For compliance documentation

TLS Endpoints¶

Every scan also reads the host names your Azure services serve over TLS and the certificate each one presents, whether or not that certificate is in Key Vault. A scan of a corporate tenant reads that tenant's endpoints too. Open Assets → Scan → TLS Endpoints to see them. The list is available on every tier.

Covered: App Service, Application Gateway, Front Door, API Management and Container Apps.

Not covered: virtual machines, AKS ingress and sites hosted outside Azure.

It needs no new permission: the Reader role CertifyClouds already has on each subscription covers it. It reads certificate details such as subject, issuer and expiry, never private keys.

What the list shows¶

Filter by resource type, certificate source, expiry (within 7, 30 or 90 days, already expired, or not reported by Azure) and subscription, or search by host or resource. Click a row to see the certificate's subject, issuer, the names it covers, thumbprint and validity dates, with a link to the resource in the Azure portal.

On PRO the list also shows which Key Vault certificate each endpoint uses and whether it picks up a renewal on its own. See TLS endpoints and Key Vault certificates.

Expiry checks and alerts¶

Compliance rules T001 to T003 check the expiry of the certificate each endpoint serves (see Compliance rules).

A certificate uploaded straight to an Azure service is not in Key Vault, so the Key Vault checks cannot see it. CertifyClouds sends expiry alerts for it (see TLS endpoint certificates). To renew one, get a new certificate from the CA that issued it and upload it to the resource. Storing it in Key Vault instead, and pointing the resource at it without a version number, lets the resource pick up each renewal and lets CertifyClouds track its expiry in Key Vault.

A certificate an endpoint serves from Key Vault alerts through that Key Vault certificate, so it never alerts twice. Certificates Azure renews itself do not alert.

When a subscription could not be fully read¶

If a scan could not read some of a subscription's resources, the TLS Endpoints tab shows a notice naming the subscription and the resource type. The list for them may be incomplete, and TLS compliance rules that would otherwise pass show as not evaluated until a scan reads them.

• CertifyClouds' access does not include reading these resources: give CertifyClouds the Reader role on the whole subscription, then run a scan. Reader granted only on resource groups cannot be confirmed from the subscription, so the notice stays until Reader covers the subscription.
• The read failed, or CertifyClouds could not check its own access: run a scan to try again.

Scan Performance¶

Configuration¶

Tune scan performance in Settings → Advanced → Performance; Max Workers is an environment variable only:

Performance Tips¶

1. Use Quick Scans on large estates: they skip vaults read within the scan cache lifetime, so changes made in Azure since then show on the next full scan
2. Reduce Workers: If hitting Azure API rate limits, reduce max workers
3. Subscription Filtering: Scan only needed subscriptions to reduce time
4. Schedule Off-Peak: Run full scans during low-usage periods

Typical Scan Times¶

Scheduled Scanning¶

CertifyClouds can automatically run Key Vault scans on a schedule:

Configure Schedule¶

Key Vault scanning runs on a background worker. You need an admin account to change it.

1. Go to Settings → Advanced → Workers
2. Under Scan & Discovery Workers, find Assets Scan
3. Turn on Auto-scan
4. Pick how often it runs: every 30 minutes, 1, 2, 4, 6, 12 or 24 hours

The change saves as soon as you make it. There is no cron expression field. The card shows when the scan last ran and whether the worker is enabled. Non-admin users see the same card without the controls.

Scheduled runs are always full scans. Quick scan is available from the Run Scan menu and through the API, not on the schedule.

Best Practices¶

• Run at least once daily for compliance monitoring
• Monitor scan history for performance trends

Filtering and Search¶

Filter Options¶

Search¶

Search across all assets by:

• Name (partial match)
• Tags (key or value)
• Content type
• Vault name

Troubleshooting¶

"Access denied" for some vaults¶

Cause: CertifyClouds doesn't have read permissions on the vault.

Fix: Run the setup script to grant permissions:

./setup-certifyclouds-access.sh --principal-id $PRINCIPAL_ID --apply

"Network unreachable" errors¶

Cause: Key Vault has firewall enabled and CertifyClouds IP is blocked.

Fix: Add your subnet to the vault's firewall rules, or use private endpoints.

Slow scan times¶

Cause: Too many concurrent workers hitting rate limits.

Fix: Reduce DISCOVERY_MAX_WORKERS to 3 or lower.

Missing subscriptions¶

Cause: CertifyClouds doesn't have Reader role on the subscription.

Fix: Grant Reader role at subscription scope:

az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role Reader \
  --scope /subscriptions/<subscription-id>

API access¶

Scan endpoints are listed in API Endpoints; exact request and response shapes are in your deployment's /docs.

Best Practices¶

1. Run Regular Scans: Schedule daily scans for continuous monitoring
2. Act on Critical: Address critical expiration items immediately
3. Set Up Alerts: Configure email/webhook alerts for expiring assets
4. Review Compliance: Check compliance score after each scan
5. Archive History: Keep scan history for audit trails