Vault Url — full URL of the Key Vault (e.g., https://my-vault.vault.azure.net/).
Auth-dependent attributes (see Authentication methods): Tenant Id, Client Id,
Client Secret (Service Principal) or Certificate and Certificate Password
(Certificate). The recommended Polysync Service Principal method needs none.
Authentication methods
Polysync Service Principal ⭐ (recommended) — no extra attributes;
grant the Polysync Enterprise Application Key Vault Secrets User on the
vault. This is the standard method for all Polysync tenants.
Service Principal — Tenant Id, Client Id, Client Secret. Use when
you need a dedicated SPN per vault. Rotate the secret regularly; store it
in another vault if possible.
Register the resource provider on a subscription that has never used Key Vault:
az provider register --namespace Microsoft.KeyVault --wait. Vault creation otherwise fails with
MissingSubscriptionRegistration.
The Polysync application must be present in your tenant. It is created automatically when the
subscription is bought through Azure Marketplace; for any other tenant an administrator consents
to the Polysync enterprise application once. The Setup editor shows its client ID beside the
auth-method hint.
New vaults open with Polysync Service Principal already selected.
Permissions checklist
The chosen identity must have the Key Vault Secrets User RBAC role
(or an equivalent access policy entry granting Get and List). Key Vault Secrets User
alone is sufficient — it includes listing secret metadata (secrets/readMetadata) as well as
reading values, so Test Connectivity, the secret picker and vault:// references all work.
Key Vault Reader adds nothing on top of it and is not enough by itself.
Networking. Polysync reads the vault over its public endpoint from a single fixed outbound
address, shown in this editor's hint strip. To firewall the vault, set the default action to Deny
and allow-list that address (or simply allow trusted Microsoft services, which is broader).
A vault with a private endpoint cannot be reached — even if you also leave public access enabled.
The private endpoint rewrites the vault's public name (<vault>.vault.azure.net →
<vault>.privatelink.vaultcore.azure.net), and Polysync resolves that name to nothing (no public
fallback), so the connection never starts. No firewall setting fixes this; the private endpoint must
be removed for Polysync to reach the vault over the public endpoint.
A firewall denial is reported with the same message as a missing role — "Access denied: The
provided credentials do not have sufficient permissions to access this Key Vault". If Test
Connectivity fails that way, check the role assignment and the firewall (and that the outbound
address above is allow-listed).
New RBAC role assignments can take a few minutes to take effect — wait and retry before
concluding the grant is wrong.