Debug log reporting

Logs generated by other plugins are reported by Plugin #84239: Debugging Log Report. Debug logs for the Azure Key Vault integration are written by the Tenable Nessus scanner during the scan. Debugging log report output is controlled by the debug logging settings in Nessus.

The integration writes to log files named after the credential plugin that invoked it, with "Azure Key Vault" appended so the PAM-integration log lines can be distinguished from the target-authentication log lines:

  • SSH: ssh_settings.nasl~Azure Key Vault

  • Windows (SMB): logins.nasl~Azure Key Vault

  • Database: database_settings.nasl~Azure Key Vault

  • VMware vCenter: vmware_vcenter_settings.nbin~Azure Key Vault

  • VMware ESXi: vmware_soap_settings.nbin~Azure Key Vault

  • Nutanix Prism Central: nutanix_settings.nasl~Azure Key Vault

What the logs contain:

  • Configuration settings loaded from the scan policy (with sensitive values — secret values, access tokens, passwords, and SSH keys — automatically scrubbed).

  • The OAuth2 token request against login.microsoftonline.com and whether authentication to Microsoft Entra ID succeeded.

  • Cache hit/miss information for both the access token and the retrieved secret.

  • The Key Vault secret GET request URL (with the Key Vault name and secret name) and the HTTP response status.

  • Whether the secret value was successfully parsed as JSON, and which fields were extracted (with sensitive values masked).

  • Any errors returned by Microsoft Entra ID or Azure Key Vault, including 401 Unauthorized (bad tenant/client credentials), 403 Forbidden / ForbiddenByRbac (missing Key Vault Secrets User role), and 404 Not Found (secret does not exist or vault name is wrong).

Common reasons for credentialed checks showing "no" status:

  • The service principal does not have the Key Vault Secrets User role on the target vault, or the role assignment has not yet propagated (RBAC changes can take several minutes).

  • The Client Secret was rotated in Azure and the new value was not updated in the Tenable scan credential.

  • The Tenant ID, Application ID, or Key Vault Name in the credential does not match the values registered in Azure.

  • The Key Vault firewall is enabled and the scanner's public egress IP is not on the allow-list.

  • The Key Vault secret value is not valid JSON (or is JSON that is missing the password / ssh_key fields), causing the parsed credential to be empty.

  • The scanner host resolves login.microsoftonline.com or *.vault.azure.net over IPv6 only. If the scanner network does not have working IPv6 egress, prefer IPv4 for these hostnames on the scanner.