Microsoft Azure Key Vault Integration limitations

• The Azure Key Vault endpoint (<key_vault_name>.vault.azure.net) and the Microsoft Entra ID token endpoint (login.microsoftonline.com) must be reachable over HTTPS (TCP 443) from every Tenable Nessus scanner used in the scan. If the Key Vault firewall is enabled, the scanner's public egress IP must be on the allow-list.

• Only the Secrets object type is supported. The Keys and Certificates objects are out of scope for this integration (see the previous section for the reason).

• Only OAuth2 client-credentials authentication is supported. The service principal must have the Key Vault Secrets User role (or a role that includes the Microsoft.KeyVault/vaults/secrets/getSecret/action data action) on the vault.

• There is no auto-discovery or dynamic-scanning variant for this integration. Each Tenable scan credential resolves a fixed Key Vault secret name; targets must be enumerated explicitly in the scan.

• Azure Key Vault imposes a service limit of approximately 4,000 secret GET operations per 10 seconds per vault / region. Scans of very large fleets that all pull from the same vault should account for this ceiling.

• Microsoft Entra ID access tokens issued for the OAuth2 client-credentials flow have a lifetime randomized between 60 and 90 minutes. The integration automatically requests a new token when the cached one expires.