AzureKeyVaultOptions Class

Points the custodian at an Azure Key Vault: which vault and how to authenticate to it, and nothing about which keys to use. Which keys, and therefore whether their private halves ever enter this process, is the placement choice that follows the custodian registration.

public sealed class AzureKeyVaultOptions

Inheritance System.Object → AzureKeyVaultOptions

Properties

AzureKeyVaultOptions.ClientId Property

Application (client) ID of the service principal; see TenantId.

public string ClientId { get; set; }

Property Value

System.String

AzureKeyVaultOptions.ClientSecret Property

Client secret of the service principal; see TenantId. Never hardcode it.

public string ClientSecret { get; set; }

Property Value

System.String

AzureKeyVaultOptions.KeyVaultUri Property

The vault URI, e.g. https://my-vault.vault.azure.net/.

public System.Uri KeyVaultUri { get; set; }

Property Value

System.Uri

AzureKeyVaultOptions.PooledConnectionLifetime Property

How long a pooled HTTP connection is reused before it is recycled. The Azure SDK keeps one client for the vault, so recycling connections lets it pick up DNS changes without handler rotation (default 2 minutes, matching the default IHttpClientFactory handler lifetime).

public System.TimeSpan PooledConnectionLifetime { get; set; }

Property Value

System.TimeSpan

AzureKeyVaultOptions.TenantId Property

Tenant ID of the service principal. When TenantId, ClientId and ClientSecret are all set the custodian authenticates with a client-secret credential; leave them blank to fall back to the default Azure credential chain (a managed identity in production, an Azure CLI sign-in, or the AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET environment variables). Source the secret from the environment or a secret store, never hardcode it.

public string TenantId { get; set; }

Property Value

System.String