Key Vault secrets and keys without expiry

Secrets such as connection strings, API keys and passwords persist for the whole life of the application that uses them, which raises the exposure if one is ever copied. Microsoft recommends rotating secrets regularly and keeping management data such as rotation schedules and expiration dates alongside each secret (Microsoft Learn: Secure your Azure Key Vault secrets). An expiration date makes that expectation visible: once it passes, someone has to act, and Key Vault can raise near-expiry and expired events for automation.

An item with no expiry has no such deadline, so forgotten secrets and keys quietly stay live.

This script is read-only: it only lists vaults, secrets and keys and prints metadata. It does not read secret values and changes nothing. The signed-in identity needs permission to list secrets and keys in each vault (through the vault's access policy or an Azure RBAC data-plane role); vaults where listing is denied are reported and skipped. See az keyvault secret and az keyvault key.

az login

for v in $(az keyvault list --query "[].name" -o tsv); do
  echo "== $v"
  az keyvault secret list --vault-name "$v" \
    --query "[?attributes.expires==null].{type:'secret', name:name, enabled:attributes.enabled}" -o table \
    || echo "cannot list secrets in $v"
  az keyvault key list --vault-name "$v" \
    --query "[?attributes.expires==null].{type:'key', name:name, enabled:attributes.enabled}" -o table \
    || echo "cannot list keys in $v"
done

Add --subscription to az keyvault list to cover other subscriptions one at a time.

Each row is a secret or key whose expires attribute is empty. Check three things per row:

• enabled = true: the item is live and has no deadline. These come first.
• enabled = false: already switched off. Decide whether it should be deleted.
• The name: it usually tells you which application owns it, which tells you who to ask.

A vault that prints nothing under its heading has no secrets or keys without an expiry.

1. For each live item, find the owning application or team.
2. Choose an expiration date that matches your rotation policy and set it on the item, rotating the value at the same time where the secret is old.
3. Where it is possible, automate rotation as described in the Microsoft guidance, and use dual credentials for zero-downtime changes.
4. Make an expiry date part of how new secrets and keys are created, then run the script again to confirm the list is empty.

ConfigCobra's Inventory covers Azure resources across your subscriptions, including Key Vault, with a built-in risk view for Key Vault secrets and keys without expiry. Every connected cloud is scanned automatically every day, findings are linked to the inventory objects they concern, and the view can be exported as CSV. ConfigCobra reads your Azure with Reader access and never writes to it.