Azure Keyvault secret change notification using Event Grid Subscription and Logic App or Azure function

 To create triggers for changes in Azure Key Vault secrets, you can leverage Azure Event Grid by setting up an event subscription on your Key Vault that will fire an event whenever a secret is updated, deleted, or created, allowing you to then configure an action like a Logic App or Azure Function to respond to these changes. 

Key steps:

• Configure Event Grid subscription:

  • Go to your Azure Key Vault in the portal. 
  • Navigate to the "Events" tab. 
  • Select "Create event grid subscription". 
  • Choose a suitable Event Grid topic or create a new one. 
  • Select the event types you want to monitor, such as "SecretNewVersionCreated" or "SecretNearExpiry". 
• Create a consuming application:

  • Logic App: Set up a Logic App with an Event Grid trigger that will be activated when an event is published by your Key Vault. 
  • Azure Function: Develop an Azure Function that is triggered by the Event Grid event and performs the desired actions based on the secret change. 

  Important considerations:

  • Access control:

    Ensure your consuming application (Logic App or Function) has the necessary permissions to access your Key Vault to read the updated secret values. 
  • Filtering events:

    You can filter the events received by your consuming application based on specific secret names or other criteria using Event Grid filters. 

  Example use cases for secret change triggers:

  • Automatic application reconfiguration: When a secret is updated in Key Vault, trigger a deployment to update your application configuration with the new secret value. 
  • Notification alerts: Send notifications to administrators when critical secrets are changed or near expiry. 
  • Data synchronization: Update data in another system based on changes to a secret in Key Vault.