Beta

Set up Microsoft Azure

Beta: discover App Services, Function Apps and Key Vaults, import explicitly readable app settings, and sync controlled values with names-only preview and provider evidence.

1. Create the token

Create a single-tenant Microsoft Entra application and client secret. Grant Reader only on each allowed subscription for guided discovery, then grant App Service configuration read/list/write on each selected app and Key Vault secret metadata-list/set on each selected vault. Do not grant Owner, Contributor, secret get, delete or purge.

2. Identify resources

Copy the tenant ID, application client ID, client-secret expiry and allowed subscription IDs. HushVault verifies every allowed subscription, then lists App Services, Function Apps and Key Vaults using ARM metadata only.

3. Preview before writing

Azure Public Cloud only; sovereign-cloud hosts are rejected.
Ordinary App Service settings are readable but Azure does not classify their sensitivity, so import is always explicit.
Key Vault discovery returns names and metadata only; HushVault never requests secret get, delete or purge.
App Service uses a replace-all API. HushVault checks for a moving snapshot and verifies the result; do not edit the same settings during a run.

Role-aware setup

Admins connect. Everyone can follow the guide.

Organisation owners and admins can store or rotate provider credentials. Members and viewers can use this guide and ask an admin to complete the connection.

Start guided setup