feat(secret-sync): add option to disable certificate import in Azure Key Vault sync by IgorHorta · Pull Request #5755 · Infisical/infisical

IgorHorta · 2026-03-19T00:20:17Z

Context

This PR implements a new "Disable Certificate Import" option for Azure Key Vault Secret Sync. When enabled, Infisical will skip importing certificate-backed secrets (those with contentType application/x-pkcs12 or application/x-pem-file) from Azure Key Vault.

Why: Azure Key Vault exposes certificates through the Secrets API, which some users want to filter out to keep their Infisical secrets project focused only on actual secrets rather than certificate objects.

How it works: The filtering happens at the list stage (before fetching individual secret values) using the contentType field returned in the AKV List Secrets API response, avoiding unnecessary API calls.

Related ticket: ENG-4687

Changes

Backend

Added contentType?: string field to GetAzureKeyVaultSecret interface to capture certificate type information
Created AzureKeyVaultSyncOptionsSchema with disableCertificateImport boolean option
Updated base schema builders to accept sync options schemas as parameters
Implemented certificate filtering logic in sync functions that respects the new option
Added constant documentation for the new option in API docs
Updated all three sync operation handlers (create, update, delete) to pass the option to the fetch function

Frontend

Updated TAzureKeyVaultSync type to include disableCertificateImport in syncOptions
Added disableCertificateImport field to AzureKeyVaultSyncDestinationSchema (optional, defaults to false)
Created AzureKeyVaultSyncOptionsFields component with a toggle switch and tooltip
Wired the new component into SecretSyncOptionsFields switch statement
Fixed Azure Key Vault connection form to make tenantId optional for OAuth method (related fix)

Documentation

Updated Azure Key Vault sync configuration guide with description of the new option
Updated vault-options.png screenshot to show the new option

Steps to verify the change

Navigate to Organization > App Connections and configure an Azure Key Vault connection
Create a new secret sync with Azure Key Vault as the destination
On the options step, verify the new "Disable Certificate Import" toggle appears
Enable the toggle and create the sync
Verify that certificate objects from Azure Key Vault are not imported into the sync when the option is enabled
Disable the toggle and verify certificates are imported normally

Screenshots

Updated vault-options.png showing the new toggle in the UI configuration screen.

Type

Checklist

Title follows the conventional commit format
Tested locally (pending local testing)
Updated docs (Azure Key Vault sync documentation)
Updated CLAUDE.md files (not needed for this change)
Read the contributing guide

…t sync Add optional contentType field to GetAzureKeyVaultSecret interface and create AzureKeyVaultSyncOptionsSchema with disableCertificateImport field. Update the base schema builders to accept sync options schemas as a parameter, allowing destination-specific options to be included in create/update sync endpoints.

… Vault sync Add certificate content type detection to filter out application/x-pkcs12 and application/x-pem-file secrets when disableCertificateImport option is enabled. Filtering happens at the list stage before fetching individual secret values, avoiding unnecessary API calls. Update all three sync operation handlers (create, update, delete) to pass the option to the fetch function.

Add description for the new AZURE_KEY_VAULT.disableCertificateImport option in the SecretSyncs constants, making it available for API documentation.

Update TAzureKeyVaultSync type to include disableCertificateImport as an optional field in syncOptions, matching the backend schema.

Add disableCertificateImport field to AzureKeyVaultSyncDestinationSchema as an optional boolean that defaults to false.

Create AzureKeyVaultSyncOptionsFields component with a toggle switch for the disableCertificateImport option, including tooltip documentation. Wire it into SecretSyncOptionsFields switch statement to render for Azure Key Vault syncs.

Update oauthSchema to make tenantId optional since OAuth flow doesn't require it for Azure Key Vault connections. Fix submit button disable logic to properly allow submission for new OAuth connections.

Add documentation for the new Disable Certificate Import option in the Azure Key Vault sync configuration guide, explaining when and why to enable it. Update the vault-options.png screenshot to show the new option.

linear · 2026-03-19T00:20:20Z

ENG-4687 Add option to disable certificate import in AKV Secret Sync

maidul98 · 2026-03-19T00:20:57Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

IgorHorta · 2026-03-19T00:24:00Z

@greptile review this!

greptile-apps · 2026-03-19T00:29:10Z

Greptile Summary

This PR adds a disableCertificateImport option to the Azure Key Vault Secret Sync that, when enabled, filters out certificate-backed secrets (identified by their contentType) from the AKV list response before fetching individual values. The feature is well-documented, follows existing patterns for sync options (schema, UI toggle, type definitions), and correctly addresses the previous review comment by moving the certificate content-type constant to module scope.

Key changes:

Backend: New AzureKeyVaultSyncOptionsSchema with disableCertificateImport boolean, filtering applied at list-stage in $getAzureKeyVaultSecrets, option threaded through all three sync operations.
Frontend: New AzureKeyVaultSyncOptionsFields toggle component wired into the sync options form; TAzureKeyVaultSync type extended with the new option.
Connection form fix: OAuth tenantId made optional (with fallback to "common") and the submit button is now enabled for OAuth even with a clean form — a reasonable UX fix.
Documentation: Updated azure-key-vault.mdx and screenshot to describe the new option.

Two issues worth attention:

When disableCertificateImport=true, certificate secrets are excluded from vaultSecrets, so syncSecrets may attempt to PUT Infisical secrets whose names match AKV certificates. AKV rejects such writes, causing SecretSyncError failures for users who previously imported certificates before enabling the option.
In AzureKeyVaultConnectionForm, the Tenant ID <Controller> uses name="credentials.tenantId" for both methods, but oauthSchema defines tenantId at the top level — meaning the value entered in OAuth mode is silently ignored when constructing the OAuth redirect URL (pre-existing issue surfaced by this PR's change).

Confidence Score: 3/5

Mostly safe but has a logic gap in the sync direction that can produce sync failures when the option is toggled on an existing sync with previously imported certificates.
The schema, UI, and documentation changes are clean and correct. The primary concern is in syncSecrets: by removing certificates from vaultSecrets, Infisical may attempt to push certificate-named secrets to AKV, which AKV rejects. There is also a pre-existing form path mismatch in the OAuth connection form that is surfaced (though not introduced) by this PR.
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-fns.ts (sync direction logic) and frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureKeyVaultConnectionForm.tsx (Controller path mismatch for OAuth tenantId).

Important Files Changed

Filename	Overview
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-fns.ts	Implements certificate filtering via a new `disableCertificateImport` param; the filter is applied to `vaultSecrets` before enabled/disabled splits, but when this option is on, `syncSecrets` will attempt to push Infisical secrets whose names match AKV certificates back to AKV, causing sync failures since AKV rejects writes to certificate-managed secrets.
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-schemas.ts	Adds `AzureKeyVaultSyncOptionsSchema` with the optional `disableCertificateImport` boolean and correctly threads it through `BaseSecretSyncSchema`, `GenericCreateSecretSyncFieldsSchema`, and `GenericUpdateSecretSyncFieldsSchema`. Schema changes look correct.
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-types.ts	Adds optional `contentType?: string` to the `GetAzureKeyVaultSecret` interface to capture the certificate content-type field from the AKV list response. Minimal, correct change.
frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureKeyVaultConnectionForm.tsx	Makes OAuth `tenantId` optional and unblocks the submit button for OAuth even when the form is clean. However, the Tenant ID `<Controller>` is bound to `credentials.tenantId` for both methods, while `oauthSchema` defines `tenantId` at the top level; the value entered in OAuth mode is silently ignored when building the OAuth redirect URL (pre-existing bug surfaced by this change).
frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/AzureKeyVaultSyncOptionsFields.tsx	New component that renders a toggle switch for `disableCertificateImport` using `react-hook-form` Controller; follows the same pattern as other sync options fields and looks correct.

_{Last reviewed commit: "refactor(secret-sync..."}

backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-fns.ts

…cope

backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-fns.ts

backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-types.ts

...pConnections/AppConnectionsPage/components/AppConnectionForm/AzureKeyVaultConnectionForm.tsx

…pe filter

…V connection form

IgorHorta added 8 commits March 18, 2026 21:17

feat(secret-sync): document disableCertificateImport option in API docs

a0436e7

Add description for the new AZURE_KEY_VAULT.disableCertificateImport option in the SecretSyncs constants, making it available for API documentation.

feat(secret-sync): add Azure Key Vault sync options types

53eafd9

Update TAzureKeyVaultSync type to include disableCertificateImport as an optional field in syncOptions, matching the backend schema.

feat(secret-sync): add Azure Key Vault sync options schema

9be5774

Add disableCertificateImport field to AzureKeyVaultSyncDestinationSchema as an optional boolean that defaults to false.

fix(azure-key-vault): make tenantId optional for OAuth connection method

135ae14

Update oauthSchema to make tenantId optional since OAuth flow doesn't require it for Azure Key Vault connections. Fix submit button disable logic to properly allow submission for new OAuth connections.

docs(secret-sync): document Disable Certificate Import option

a5f2b4d

Add documentation for the new Disable Certificate Import option in the Azure Key Vault sync configuration guide, explaining when and why to enable it. Update the vault-options.png screenshot to show the new option.

mintlify bot deployed to staging - docs March 19, 2026 00:24 View deployment

greptile-apps bot reviewed Mar 19, 2026

View reviewed changes

backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-fns.ts Outdated Show resolved Hide resolved

refactor(secret-sync): move AKV certificate content types to module s…

e7b8e41

…cope

IgorHorta marked this pull request as ready for review March 19, 2026 00:38

varonix0 requested changes Mar 19, 2026

View reviewed changes

IgorHorta added 2 commits March 19, 2026 15:44

refactor(secret-sync): remove type cast in AKV certificate content ty…

0a5415d

…pe filter

fix(secret-sync): make tenant ID required and fix OAuth binding in AK…

eeed419

…V connection form

IgorHorta requested a review from varonix0 March 19, 2026 19:10

varonix0 approved these changes Mar 22, 2026

View reviewed changes

IgorHorta merged commit 0d47ac4 into main Mar 22, 2026
11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(secret-sync): add option to disable certificate import in Azure Key Vault sync#5755

feat(secret-sync): add option to disable certificate import in Azure Key Vault sync#5755
IgorHorta merged 11 commits intomainfrom
igor/eng-4687-add-option-to-disable-certificate-import-in-akv-secret-sync

IgorHorta commented Mar 19, 2026

Uh oh!

linear bot commented Mar 19, 2026

Uh oh!

maidul98 commented Mar 19, 2026 •

edited

Loading

Uh oh!

IgorHorta commented Mar 19, 2026

Uh oh!

greptile-apps bot commented Mar 19, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

IgorHorta commented Mar 19, 2026

Context

Changes

Backend

Frontend

Documentation

Steps to verify the change

Screenshots

Type

Checklist

Uh oh!

linear bot commented Mar 19, 2026

Uh oh!

maidul98 commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

IgorHorta commented Mar 19, 2026

Uh oh!

greptile-apps bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

maidul98 commented Mar 19, 2026 •

edited

Loading

greptile-apps bot commented Mar 19, 2026 •

edited

Loading