Azure Key Vault

Updated: July 8, 2026

Want to summarize with AI?

Learn how Cisco Multicloud Defense retrieves securely stored certificate private keys from Azure Key Vault secrets for use with TLS decryption.

Multicloud Defense integrates with many secret management systems offered by public cloud providers to store the private keys corresponding to the certificates to be used in TLS decryption. In this section, you can view the steps to retrieve a stored private key in Azure Key Vault for a certificate. Multicloud Defense supports retrieval of private keys through Azure Key Vault secrets.

Create Azure Key Vault and User-assigned Managed Identities

Multicloud Defense uses a user-assigned managed identity to access the Azure Key Vault secret. The following steps show how to create the Key Vault and how to grant the managed identity the necessary permissions to access the secret:

Procedure

	1.	Create a new User-assigned Managed Identity.
	2.	Create a new Key Vault, for example, `mcd-key-vault.`
	3.	In the newly created Key Vault, go to Access Policies.
	4.	Select Add Access Policy.
	5.	Assign Secret permissions: `Get`.
	6.	Select Principal.
	7.	Select the Managed Identity.
	8.	Staying on the Key Vault configuration, navigate to Access Control (IAM) > Select Add > Role Assignment.
	9.	Select Reader Role.
	10.	Search for the Managed Identity in the Select field and select it.
	11.	Click Save.

Store Private Keys into Azure Key Vault Secrets

Import your private key for your secret into the secrets folder of the Azure Key Vault that you have created. Since the private key is a multi-line string, this can be imported via the Azure Cloud Shell.

Start the Azure Cloud Shell and run the following command:


az keyvault secret set --file <privatekey file> --encoding ascii --vault-name <key vault name> --name <secret name>

The key file is created by simply creating a new file with a text editor (vi) in Azure Cloud Shell, pasting the contents of the private key and saving it.

Configure Multicloud Defense to Retrieve Private Key

Before you begin, ensure that the Multicloud Defense Gateway deployed in Azure is configured with the user- managed identity as specified in Azure Key Vault and User-assigned Managed Identities.

Paste the certificate body into the field associated with the private key in the Azure Key Vault secret

Once you have created the Multicloud Defense certificate, it can be used with a Decryption Profile when defining services in Multicloud Defense Controller.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.