azure-app-secret

The azure-app-secret rotator enables you to rotate client secrets for an Azure app registration in your Environment. Check out the azure-login documentation to learn more about authenticating with Azure.

Example

# my-org/logins/production
values:
  azure:
    login:
      fn::open::azure-login:
        clientId: <your-client-id>
        tenantId: <your-tenant-id>
        subscriptionId: <your-subscription-id>
        oidc: true

# my-org/rotators/secret-rotator
values:
  appSecret:
    fn::rotate::azure-app-secret:
      inputs:
        login: ${environments.logins.production.azure.login}
        clientId: <target-app-client-id>
        lifetimeInDays: 180

If you have an existing client secret you want ESC to keep track of, you can optionally provide an initial state.

# my-org/rotators/secret-rotator
values:
  appSecret:
    fn::rotate::azure-app-secret:
      inputs:
        login: ${environments.logins.production.azure.login}
        clientId: <target-app-client-id>
      state:
        current:
          secretId: <secret-id>
          secretValue:
            fn::secret: <secret-value>

Alternative: static credentials

Instead of an OIDC login, you can authenticate with a client secret by supplying clientSecret to the rotator’s login:

# my-org/rotators/secret-rotator
values:
  appSecret:
    fn::rotate::azure-app-secret:
      inputs:
        login:
          clientId: <your-client-id>
          tenantId: <your-tenant-id>
          subscriptionId: <your-subscription-id>
          clientSecret:
            fn::secret: <your-client-secret>
        clientId: <target-app-client-id>
        lifetimeInDays: 180

Configuring OIDC

To learn how to configure OpenID Connect (OIDC) between Pulumi Cloud and Azure, see the OpenID Connect integration documentation. Once you have completed these steps, you can validate that your configuration is working by running either of the following:

• pulumi env open <org>/<project>/<environment> command of the Pulumi CLI
• pulumi env open <org>/<project>/<environment> command of the Pulumi CLI

Make sure to replace <org>, <project>, and <environment> with the values of your Pulumi organization and environment identifier respectively. You should see output similar to the following:

{
  "azure": {
    "login": {
      "clientId": "b537....",
      "clientSecret": "[secret]",
      "subscriptionId": "0282....",
      "tenantId": "7060...."
    }
  },
  "appSecret": {
    "current": {
      "secretValue": "[secret]",
      "secretId": "a1b2c3d4-...",
      "createdAt": "2025-01-01T12:00:00Z",
      "expiresAt": "2025-07-01T12:00:00Z"
    },
    "previous": {
      "secretValue": "[secret]",
      "secretId": "e5f6g7h8-...",
      "createdAt": "2024-07-01T12:00:00Z",
      "expiresAt": "2025-01-01T12:00:00Z"
    }
  }
}

Permissions

The Azure identity used for rotation must have the following Microsoft Graph API permissions:

• Application.ReadWrite.All - to read applications and manage their client secrets

Alternatively, the identity can be added as an Owner of the specific app registration whose secrets will be rotated.

Schema reference

Reference schemas last updated on 2026-09-19, synced automatically from the Pulumi Cloud ESC API.

Inputs

• clientId string required
  The Application (client) ID of the app registration whose secret should be rotated.
• lifetimeInDays number optional
  The number of days the secret should be valid.
• login object required rotate-only
  The credentials to use.
• ↳ clientId string required
  The client ID to use.
• ↳ clientSecret string optional
  The client secret to use for authentication, if any.
• ↳ oidc object optional
  OIDC-related data, if OIDC is used for authentication.
• ↳ token string required
  The OIDC token to use for authentication.
• ↳ subscriptionId string optional
  The subscription ID to use.
• ↳ tenantId string required
  The tenant ID to use.

State

• current object required
  The current client secret.
• ↳ createdAt string optional
  The creation timestamp of the secret.
• ↳ expiresAt string optional
  The expiration timestamp of the secret.
• ↳ secretId string required
  The key ID of the client secret.
• ↳ secretValue string required
  The client secret value.
• previous object optional
  The previous client secret.
• ↳ createdAt string optional
  The creation timestamp of the secret.
• ↳ expiresAt string optional
  The expiration timestamp of the secret.
• ↳ secretId string required
  The key ID of the client secret.
• ↳ secretValue string required
  The client secret value.

Outputs

• current object required
  The current client secret.
• ↳ createdAt string optional
  The creation timestamp of the secret.
• ↳ expiresAt string optional
  The expiration timestamp of the secret.
• ↳ secretId string required
  The key ID of the client secret.
• ↳ secretValue string required
  The client secret value.
• previous object optional
  The previous client secret.
• ↳ createdAt string optional
  The creation timestamp of the secret.
• ↳ expiresAt string optional
  The expiration timestamp of the secret.
• ↳ secretId string required
  The key ID of the client secret.
• ↳ secretValue string required
  The client secret value.

Troubleshooting

Related

• Rotators - How credential rotation works in Pulumi ESC
• azure-login - Authenticate with Azure via OIDC or a client secret
• Configuring OIDC for Azure - Set up OIDC between Pulumi Cloud and Azure
• Rotators reference - Catalog of all ESC rotators