#Create a Key Vault in Azure

Make sure you have an Azure subscription that contains Azure Key Vault. Then follow the instructions below.

#Step 1: Create an Application

This application is only used for Azure Key Vault. AvePoint Online Services encryption profile will access the key vault via the application.

1. Go to (or ), navigate to Identity > Applications > App registrations (or Microsoft Entra ID > App registrations).

2. Click New registration on the ribbon.

3. On the Register an application page, configure the application settings.

4. Click Register to create your application.

5. After the application is created successfully, copy the application ID. The application ID is the client ID that will be used in the encryption profile.

#Step 2: Add a Client Secret for the Application

The client secret will be used in the AvePoint Online Services encryption profile.

1. After creating the application, click Certificates & secrets in the left menu.

2. In the Client secrets field, click New client secret.

3. In the Add a client secret pane, enter a description for the client secret and select a duration.

4. Click Add. The value of the client secret is automatically generated and displayed.

5. Copy the client secret value. You will need to provide the value when configuring the encryption profile.

   *Note: The value will be hidden after you leave or refresh the page.

#Step 3: Create a Key Vault

According to your permission model (Azure RBAC or Key Vault access policy), refer to the instructions in the related sections below.

#Azure RBAC (Role-based Access Control)

Follow the steps below to create a key vault:

1. Open the .

2. Search for Key vaults, and then click the result to access the Key vaults page.

3. Click Create. The Create a key vault page appears.

4. In the Basics tab, provide the basic information for the key vault, and then click the Access configuration tab.

5. In the Permission model section, select Azure role-based access control (recommended).

6. Click the Networking tab.

7. Select Enable public access which allows all networks to connect to this key vault.

   *Note: If you only allow AvePoint Online Services and the AvePoint cloud services you are using to connect to this key vault, you can edit the key vault’s firewall settings after the key vault provisioning.

8. Click the Tags tab, and you can add tags to categorize your key vault.

9. Click Review + create to review all of your configurations first, and then click Create at the bottom to create the key vault.

   *Note: If you need to change some settings before creating the key vault, you can click the Previous button to change previous settings.

After the key vault is created, follow the steps below to assign the role:

1. Open the , and navigate to the Key Vaults resource.

2. Click Access control (IAM) in the Key Vault’s menu.

3. Click Add and select Add role assignment.

4. In the Role list, select Key Vault Crypto User.

5. Go to the Members tab.

6. In the Assign access to section, select User, group, or service principal.

7. Click Select members.

8. Search for and select your application.

   

9. Click Review + assign to complete the role assignment.

#Vault access policy

Follow the steps below to create a key vault:

1. In the , enter Key vaults in the search box on the top, and then select the first result to access the Key vaults page.

2. Click Create. The Create a key vault page appears.

3. In the Basics tab, provide the basic information for the key vault, and then click the Access configuration tab.

4. In the Permission model section, select Vault access policy.

5. In the Access policies section, click Create.

6. The Create an access policy pane appears. In the Permissions tab, select the following Key permissions:

   • In the Key Management Operations field, select Get.

   • In the Cryptographic Operations field, select Decrypt and Encrypt.

7. Click Next to go to the Principal tab.

8. In the Principal pane, complete the following steps:

   1. Enter the application name or application ID in the search box.

   2. Select the application and click Select at the bottom.

   3. Click Next at the bottom.

9. Click Create to add the access policy.

10. Click the Networking tab.

11. Select Enable public access which allows all networks to connect to this key vault.

    *Note: If you only allow AvePoint Online Services and the AvePoint cloud services you are using to connect to this key vault, you can edit the key vault’s firewall settings after the key vault provisioning.

12. Click the Tags tab, and you can add tags to categorize your key vault.

13. Click Review + create to review all of your configurations first, and then click Create at the bottom to create the key vault.

    *Note: If you need to change some settings before creating the key vault, you can click the Previous button to change previous settings.

#Step 4: Create a Key

Follow the steps below to create a key:

1. On the Key vaults page, click the newly created key vault.

2. Click Keys in Objects. In the Keys pane, click Generate/Import on the ribbon and create a key.

3. In the Keys pane, click the key name, and then click the current version. The key properties are displayed.

4. Copy the key identifier. You will need to provide the key identifier when configuring the encryption profile.

#Step 5: Edit the Key Vault’s Firewall

If you only allow AvePoint Online Services and the AvePoint cloud services you are using to connect to the key vault, complete the following steps to edit the key vault’s firewall:

1. On the Key vaults page, click the name of the key vault you created, and then click Networking in Settings.

2. In the Firewalls and virtual networks tab, select Allow public access from specific virtual networks and IP addresses.

3. In the Firewall field, enter the IP addresses of AvePoint Online Services and the AvePoint cloud services you are using in the text boxes.

   *Note: To get the IP addresses, sign in to AvePoint Online Services and navigate to Administration > Security > Reserved IP address.

4. Click Save to save your configurations.