Ansible Automation Platform 2.5 - Azure key vault integration

[Pranav_Jayaraj]

Hello Team,

I need some help with Ansible Automation Platform (AAP) 2.5. I'm working on a project and have a question.

If we have certain variables, such as passwords or secrets, stored in Azure Key Vault, how can we integrate Key Vault with AAP to retrieve those values and use them within a playbook?

Looking forward to your guidance.

Thanks!

[Wasim_Raja]

@Pranav_Jayaraj Please checkout the below collection

https://docs.ansible.com/ansible/latest/collections/azure/azcollection/index.html 

[blockedprocess]

In case others stumble across this, you need to create a credential using the credential type of Microsoft Azure Key Vault using a service principal in Azure that has access to the key vault you want to retrieve secrets from.

Once that's created, create a Machine credential and click the key next to the password text box and choose the Microsoft Azure Key Vault credential you created previously.  Provide the secret name who's value you want to retrieve, and test.  If successful, you can save and then use that machine credential to retrieve the value from your Azure key vault upon template runs.

If anyone else knows, I'm curious if this same process could be replicated to retrieve an Azure Key Vault key rather than a secret.

[Priyanshu20041]

Hello @Pranav_Jayaraj 

AAP 2.5 doesn’t have a built-in Azure Key Vault credential type, but it integrates cleanly using standard Ansible methods.

The usual and recommended approach is to retrieve secrets from Azure Key Vault at playbook runtime. You authenticate to Azure using a Service Principal (stored securely in AAP as a credential), then use Ansible modules or lookups to pull the required secrets.

How it works at a high level:

• Store passwords and secrets in Azure Key Vault

• Create an Azure Service Principal with access to the vault

• Save those credentials securely in AAP

• Fetch secrets dynamically during playbook execution and use them as variables

This keeps secrets out of playbooks, limits exposure, and follows security best practices using Azure RBAC and Key Vault access policies.