Overview
The Azure secrets engine in HashiCorp Vault supports on-demand generation of Azure service principals, along with role and group assignments that are managed through Vault leases. Normally, Vault connects to Azure using static credentials (like a client ID and secret), which must be carefully protected and periodically rotated.
By adopting Workload Identity Federation (WIF), this process becomes more secure and flexible. WIF allows Vault to function as an identity provider, issuing internally signed plugin tokens (JWTs) that can be exchanged with Azure for short-lived access tokens. This eliminates the dependency on static credentials and strengthens overall secret management.
Common Errors and Resolutions:
-
Incorrect Mount Accessor
-
Error:
$ vault write azure/roles/my-role application_object_id=5bd7141b-381a-43f8-808d-26b288edda55 ttl=1h Error writing data to azure/roles/my-role: Error making API request. URL: PUT https://Vault_Server_Ip:8200/v1/azure/roles/my-role Code: 500. Errors: * 1 error occurred: * error loading Application: ClientAssertionCredential authentication failed. POST https://login.microsoftonline.com/946cf8b5-b8bf-4875-9faf-fb4bf71e56fd/oauth2/v2.0/token -------------------------------------------------------------------------------- RESPONSE 401: 401 Unauthorized -------------------------------------------------------------------------------- { "error": "invalid_client", "error_description": "AADSTS700x 700213 ], "timestamp": "2025-09-23 10:27:14Z", "trace_id": "c176b5f5-c0b3-450c-a8c7-bd0588ea9200", "correlation_id": "588ef555-b3b8-4fc6-9eb5-900132cc1810", "error_uri": "https://login.microsoftonline.com/error?code=700213" } -
Root Cause:
This typically happens when the mount accessor configured for the Azure secrets engine does not match the accessor value referenced in the WIF setup. As a result, Azure cannot validate the presented token signature.
-
Remediation:
-
Ensure that the correct mount accessor is configured in the WIF setup. AZURE_MOUNT_ACCESSOR can be retrieved using the below output for the azure mount:
$ vault secrets list
Locate the accessor corresponding to the Azure secrets engine mount and verify that the same accessor is used in the WIF configuration.
-
-
-
Missing Issuer
-
Error:
$ vault write azure2/roles/my-newrole application_object_id=xxxxxxxxxxxxxxx-8fc0-82xxxxxef943 ttl=1h Error writing data to azure2/roles/my-newrole: Error making API request. URL: PUT https://Vault_Server_IP:8200/v1/azure2/roles/my-newrole Code: 500. Errors: * 1 error occurred: * error loading Application: ClientAssertionCredential authentication failed. POST https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token -------------------------------------------------------------------------------- RESPONSE 401: 401 Unauthorized -------------------------------------------------------------------------------- { "error": "invalid_client", "error_description": "AADSTS700211: No matching federated identity record found for presented assertion issuer 'https://my-new-vault.nitesh.aws.sbx.hashicorpdemo.com:8200/v1/identity/oidc/plugins'. Please check your federated identity credential Subject, Audience and Issuer..." } -
Root Cause:
Azure could not find a matching federated identity record for the issuer specified in Vault’s WIF token. This usually means the Issuer URL or Audience defined in the Azure Federated Identity Credential does not align with Vault’s actual OIDC issuer endpoint.
-
Remediation:
-
To fix this, retrieve the OIDC Issuer detail from Vault OIDC Plugin:
$ vault read identity/oidc/plugins/.well-known/openid-configuration Key Value --- ----- id_token_signing_alg_values_supported [RS256 RS384 RS512 ES256 ES384 ES512 EdDSA] issuer https://my-new-vault.test.aws.sbx.hashicorpdemo.com:8200/v1/identity/oidc/plugins jwks_uri https://my-new-vault.test.aws.sbx.hashicorpdemo.com:8200/v1/identity/oidc/plugins/.well-known/keys response_types_supported [id_token] subject_types_supported [public] -
Then set the OIDC Issuer value:
$ vault write -f identity/oidc/config issuer=https://my-new-vault.test.aws.sbx.hashicorpdemo.com:8200
-
-
-
Insufficient Permissions in Azure
-
Error:
$ vault read azure/creds/my-role Error reading azure/creds/my-role: Error making API request. URL: GET https://Vault_Server_IP:8200/v1/azure/creds/my-role Code: 500. Errors: * 1 error occurred: * error updating credentials: Insufficient privileges to complete the operation. -
Root Cause:
The Azure service principal or federated identity Vault is using lacks required permissions or roles to perform the requested action.
-
Remediation:
Make sure the following API Permissions are assigned to the federated identity:
Open the App Registration
- Go to Manage → API permissions
- Select Add a permission → Microsoft Graph
- Add the required permissions as shown in the reference screenshot
- Click "Grant admin consent for Default Directory"
Reference Articles
Plugin Workload Identity Federation (WIF)
Configuring Workload Identity Federation with Azure in Vault
-