# Source: https://infisical.com/docs/integrations/app-connections/azure-client-secrets.md

> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Client Secrets Connection

> Learn how to configure an Azure Client Secrets Connection for Infisical.

Infisical currently only supports two methods for connecting to Azure, which are OAuth and Client Secrets.

<Accordion title="Self-Hosted Instance">
  Using the Azure Client Secrets connection on a self-hosted instance of Infisical requires configuring an application in Azure
  and registering your instance with it.

  **Prerequisites:**

  * Set up Azure.

  <Steps>
    <Step title="Create an application in Azure">
      Navigate to Azure Active Directory > App registrations to create a new application.

      <Info>
        Azure Active Directory is now Microsoft Entra ID.
      </Info>

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-aad.png" alt="Azure client secrets" />
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-new-app.png" alt="Azure client secrets" />

      Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/organization/app-connections/azure/oauth/callback`.

      <Tip>
        The domain you defined in the Redirect URI should be equivalent to the `SITE_URL` configured in your Infisical instance.
      </Tip>

            <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/register-callback.png" alt="Azure client secrets" />
    </Step>

    <Step title="Assign API permissions to the application">
      For the Azure Connection to work with Client Secrets, you need to assign the following permission to the application.

      #### Azure Client Secrets permissions

      Set the API permissions of the Azure application to include the following permissions:

      * Microsoft Graph
        * `Application.ReadWrite.All`
        * `Application.ReadWrite.OwnedBy`
        * `Application.ReadWrite.All` (Delegated)
        * `Directory.ReadWrite.All` (Delegated)
        * `User.Read` (Delegated)

            <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-client-secrets/app-api-permissions.png" alt="Azure client secrets" />
    </Step>

    <Step title="Add your application credentials to Infisical">
      Obtain the **Application (Client) ID** and **Directory (Tenant) ID** (this will be used later in the Infisical connection) in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/config-credentials-1.png" alt="Azure client secrets" />
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-credentials-2.png" alt="Azure client secrets" />
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-credentials-3.png" alt="Azure client secrets" />

      Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.

      * `INF_APP_CONNECTION_AZURE_CLIENT_SECRETS_CLIENT_ID`: The **Application (Client) ID** of your Azure application.
      * `INF_APP_CONNECTION_AZURE_CLIENT_SECRETS_CLIENT_SECRET`: The **Client Secret** of your Azure application.

      Once added, restart your Infisical instance and use the Azure Client Secrets connection.
    </Step>
  </Steps>
</Accordion>

<AccordionGroup>
  <Accordion title="Client Secret Authentication">
    Ensure your Azure application has the required permissions that Infisical needs for the Azure Client Secrets connection to work.

    **Prerequisites:**

    * An active Azure setup.

    <Steps>
      <Step title="Assign API permissions to the application">
        For the Azure Client Secrets connection to work, assign the following permissions to your Azure application:

        #### Required API Permissions

        **Microsoft Graph**

        * `Application.ReadWrite.All`
        * `Application.ReadWrite.OwnedBy`
        * `Application.ReadWrite.All` (Delegated)
        * `Directory.ReadWrite.All` (Delegated)
        * `User.Read` (Delegated)

                <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-client-secrets/app-api-permissions.png" alt="Azure client secrets" />
      </Step>
    </Steps>
  </Accordion>

  <Accordion title="Certificate Authentication">
    Ensure your Azure application has the required permissions that Infisical needs for the Azure Client Secrets connection to work.

    **Prerequisites:**

    * An active Azure setup.

    <Steps>
      <Step title="Assign API permissions to the application">
        For the Azure Client Secrets connection to work, assign the following permissions to your Azure application:

        #### Required API Permissions

        **Microsoft Graph**

        * `Application.ReadWrite.All`
        * `Application.ReadWrite.OwnedBy`
        * `Application.ReadWrite.All` (Delegated)
        * `Directory.ReadWrite.All` (Delegated)
        * `User.Read` (Delegated)

                <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-client-secrets/app-api-permissions.png" alt="Azure client secrets" />
      </Step>

      <Step title="Upload your certificate to your Azure App Registration">
        Navigate to the **Certificates & secrets** section of your Azure App Registration, and press the **Upload certificate** button.

        Select the **Upload** button and upload your certificate.

                <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/upload-certificate.png" alt="Upload certificate" />

        <Tip>
          Keep in mind that both the certificate and its private key are required to configure the Azure Client Secrets connection in Infisical.
        </Tip>
      </Step>
    </Steps>
  </Accordion>
</AccordionGroup>

## Setup Azure Connection in Infisical

<Steps>
  <Step title="Navigate to App Connections">
    Navigate to the **Integrations** tab in the desired project, then select **App Connections**. <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png" alt="App Connections
    Tab" />
  </Step>

  <Step title="Add Connection">
    Select the **Azure Connection** option from the connection options modal. <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/select-connection.png" alt="Select Azure Connection" />
  </Step>

  <Step title="Create Connection">
    <Tabs>
      <Tab title="OAuth">
        <Step title="Authorize Connection">
          Fill in the **Tenant ID** field with the Directory (Tenant) ID you obtained in the previous step.

          Now select the **OAuth** method and click **Connect to Azure**.

                    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/create-oauth-method.png" alt="Connect via Azure OAUth" />
        </Step>

        <Step title="Grant Access">
          You will then be redirected to Azure to grant Infisical access to your Azure account. Once granted,
          you will be redirected back to Infisical's App Connections page. <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/grant-access.png" alt="Azure Client Secrets
          Authorization" />
        </Step>
      </Tab>

      <Tab title="Client Secret">
        <Step title="Create Connection">
          Fill in the **Tenant ID**, **Client ID** and **Client Secret** fields with the Directory (Tenant) ID, Application (Client) ID and Client Secret you obtained in the previous step.

                    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/create-client-secrets-method.png" alt="Connect via Azure OAUth" />
        </Step>
      </Tab>

      <Tab title="Certificate">
        <Step title="Create Connection">
          Fill in the **Tenant ID**, **Client ID**, **Certificate (PEM format)**, and **Private Key** fields with the Directory (Tenant) ID, Application (Client) ID, Certificate and Private Key you obtained in the [previous step](#certificate-authentication).

          <Tip>
            The private key is never transmitted to Azure, and it is only used to sign the client assertion used to authenticate with Azure.
          </Tip>

                    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/create-certificate-method.png" alt="Connect via Azure Certificate" />
        </Step>
      </Tab>
    </Tabs>
  </Step>

  <Step title="Connection Created">
    Your **Azure Client Secrets Connection** is now available for use. <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/oauth-connection.png" alt="Azure Client Secrets" />
  </Step>
</Steps>