Azure · Cloud service
Azure Key Vault with OrchestrAI
Catalog exported 2026-09-02
Operate Azure Key Vault from chat: vaults, keys, secrets, rotation, and access policies with confirmation.
OrchestrAI exposes 9 Key Vault operations: 2 are low-risk (read-only or low-impact), 6 create or modify resources and run only after you confirm the plan, and 1 is destructive and requires a typed risk phrase. 6 of them also carry a step-level approval gate.
What teams use it for
Security-minded teams use OrchestrAI to create a vault, store the first application secrets, and grant a managed identity read access, each step approved before it runs. Rotating a key on a schedule reminder and checking key metadata during an audit are the other everyday tasks. There is no operation to list or delete secrets, and certificates are not covered, so secret inventory and cleanup still happen in the portal.
Every Key Vault operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Get Key Vault Key |
Get key metadata from Azure Key Vault | Low risk | No |
List Key Vault Keys |
List keys in an Azure Key Vault | Low risk | No |
Create Azure Key Vault |
Create an Azure Key Vault | Creates resources | Yes |
Get Key Vault Secret |
Get a secret from an Azure Key Vault | Creates resources | No |
Create Key Vault Key |
Create a cryptographic key in Azure Key Vault | Modifies existing | Yes |
Rotate Key Vault Key |
Rotate a cryptographic key in Azure Key Vault | Modifies existing | Yes |
Set Key Vault Access Policy |
Grant an identity access to secrets/keys in an Azure Key Vault | Modifies existing | Yes |
Set Key Vault Secret |
Set a secret in an Azure Key Vault | Modifies existing | Yes |
Delete Key Vault Key |
Delete a cryptographic key from Azure Key Vault | Destructive | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
Prompts that work
- Create a Key Vault called kv-acme-prod in rg-prod in eastus
- Set a secret named db-password in kv-acme-prod and give the acme-api managed identity get and list permission on secrets
- Rotate the key signing-key in kv-acme-prod and show me its new version metadata
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Why is deleting a Key Vault key rated critical in OrchestrAI?
- A deleted key can leave encrypted data unreadable, so the delete-key operation requires a typed risk phrase on top of the normal confirmation.
- Can OrchestrAI read a secret value from Azure Key Vault?
- Yes, getting a secret is a medium-risk operation because the value is returned in the conversation. Reading key metadata and listing keys are low risk since they expose no secret material.
- Which Key Vault operations need an extra approval step?
- 6 operations carry a step-level approval gate on top of plan confirmation: Create Azure Key Vault, Create Key Vault Key, Delete Key Vault Key, Rotate Key Vault Key, Set Key Vault Access Policy, Set Key Vault Secret. One of these is classed destructive and cannot run without a typed risk phrase.
Other Azure services
Related integrations
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.