Monitoring Key Vaults in Azure
An expired Secret or Certificate stops integrations as surely as a server outage, and it always happens on the day nobody remembered. The Nodinite Azure Monitoring Agent keeps track of the age and expiry of the Keys, Secrets, and Certificates in your Azure Key Vaults, warns you in time, and gives the right people the details—without relying on the Azure Portal.
- ✅ Instant detection of ageing or expiring Keys, Secrets, and Certificates
- ✅ Warning and Error thresholds that you adjust per Key Vault with Remote Actions
- ✅ Alerts outside Nodinite through Alarm Plugins, for example email or an HTTP webhook
- ✅ Role-based self-service for teams through role-based Monitor Views
Note
Certificate monitoring in Azure Key Vault is available from version 7.7.x.
Nodinite continuously monitors the age and status of Keys, Secrets, and Certificates in your Azure Key Vaults. You set and adjust monitoring thresholds, receive actionable alerts, and use remote commands to resolve issues quickly. For details on available Remote Actions, see the Managing Key Vault page.
Example: List of monitored Key Vaults in a Nodinite Monitor View.
How Monitoring Works
The Azure Monitoring Agent discovers your Key Vaults with the Azure REST API, checks the expiry of each Key, Secret, and Certificate against your thresholds, and reports one Resource per Key Vault to the Nodinite Monitoring Service. Users with access to a Monitor View see the state in the Web Client, and Alarm Plugins push state changes to the people on duty.
Keys, Secrets, Certificates"] -->|"Azure REST API"| AG["fa:fa-monitor-waveform Azure Monitoring Agent"] AG --> OK["fa:fa-check OK
Within thresholds"] AG --> WA["fa:fa-triangle-exclamation Warning
Warning threshold breached"] AG --> ER["fa:fa-xmark Error
Error threshold breached"] AG --> UN["fa:fa-ban Unavailable
Network or security problem"] WA -->|"State change"| AP["fa:fa-bell Alarm Plugins"] ER -->|"State change"| AP UN -->|"State change"| AP WA --> RA["fa:fa-edit Edit thresholds
Remote Action"] ER --> RA style OK fill:#93d16d style WA fill:#FFD525 style ER fill:#c33d34,color:#fff style UN fill:#c33d34,color:#fff style AG fill:#2678BD,color:#fff style RA fill:#2678BD,color:#fff
Diagram: The agent evaluates each Key Vault into OK (green), Warning (yellow), or Error and Unavailable (red) based on how close its Keys, Secrets, and Certificates are to expiry; state changes raise alerts, and you adjust thresholds with the Edit Remote Action (blue).
Monitoring Features
- State Evaluation – Nodinite evaluates the state of each Key Vault according to your defined policy.
If Nodinite can't check your Key Vault items' state, chances are no one else can use them either.
- Automatic Discovery – The Nodinite Azure Agent uses the Azure REST API to automatically discover Key Vaults in the Subscriptions you add in the agent Configuration.
- Category-based Monitoring – Nodinite groups Resources by Categories.
- Role-Based Access – Share access to individual items using one or more Monitor Views.
State Evaluation for Key Vaults
Nodinite presents each monitored Key Vault as a Resource. For example, three Key Vaults appear as three separate Resources in Nodinite.
- The Resource name matches the deployed Key Vault name.
- Monitored Key Vaults belong to the 'Key Vault' Category.
- The Application name follows this pattern:
Configuration name/Resource Group Name
Many other Azure-related Categories exist—see the Azure Logging and Monitoring Overview.
Each Resource evaluates to a state (OK, Warning, Error, Unavailable). You can override the evaluation by configuring the Expected State for any Nodinite Resource.
Key Vault
For Key Vault Resources, the state evaluates as described in the table below:
| State | Status | Description | Actions |
|---|---|---|---|
| 🚫 Unavailable | Resource not available |
|
Review prerequisites and the firewall settings |
| ❌ Error | Error threshold is breached | One or more Secrets, Keys, or Certificates is about to expire, or is expired | Edit |
| ⚠️ Warning | Warning threshold is breached | One or more Secrets, Keys, or Certificates is about to expire, or is expired | Edit |
| ✅ OK | Within user-defined thresholds | No Secrets, Keys, or Certificates breach the thresholds | Details |
If the agent can't read the Key Vault, check that the App Registration has the rights listed in Azure user rights and services and the Azure Application Access guide.
Other Certificates and Secrets Nodinite Monitors
Key Vault is one of several places where expiring credentials hide. Combine this page with:
- Monitoring App Registration for the client secrets and certificates of your Azure App Registrations.
- Monitoring Certificate for the Azure Certificate resources in your Subscriptions.
- Azure API Management Certificate monitoring for certificates in API Management Services.
- Windows Certificates for certificates in the Windows certificate stores.
- Web Service Certificates for the HTTPS certificates of Web Applications, Web Services, and APIs.
Alert history for Key Vault
During root cause analysis or other purposes, it helps to understand how often your Key Vault problems happen. If your Monitor View allows it, you can search for historical state changes for the provided time span, either for all your Key Vaults or individually. The generic instructions on how to Add or manage Monitor View detail this topic.
| Search | Resource history |
|---|---|
 Search for alert history for all resources in the Monitor View |
 Alert history for the selected Key Vault item |
Frequently asked questions
Use the Troubleshooting guide to find the FAQ and answers to known problems.