Welcome to Support Portal

Overview

During Aqua CSPM onboarding to Microsoft Azure, the deployment script registers an enterprise application and creates a client secret in Microsoft Entra ID (Azure AD). Customers may see long default validity (for example expiration in 2055) and ask how to shorten secret lifetime, rotate annually, and whether rotation affects scanning.

This article distinguishes Azure application client secrets (used for CSPM cloud account authentication) from Aqua API keys (platform authentication).

Symptoms

• Client secret for the Aqua CSPM enterprise application shows far-future expiration in Entra ID
• Security policy requires annual (or shorter) secret rotation
• Uncertainty whether updating the secret stops CSPM scans
• Confusion between Aqua legacy API keys and Azure app registration secrets

Understanding Authentication Components

CSPM cloud account onboarding in Azure does not use Aqua API keys for subscription scanning. Scanning uses the enterprise application created by the onboarding script.

Rotating an Existing Azure Client Secret

1. Generate a new secret in Azure

Using Azure CLI (replace placeholders):

az ad sp credential reset --id <service-principal-object-id> --years 1 --append

Or in the Azure portal: open the Aqua enterprise application → Certificates & secrets → New client secret.

Record the new secret value immediately; it is shown only once.

2. Update the connection in Aqua

1. In Aqua, go to CSPM → Cloud Accounts
2. Open the ⋮ menu for the Azure account
3. Choose Update Connection
4. Enter the Application (client) ID and the new client secret value
5. Save

3. Verify scanning

Trigger a manual scan from the CSPM UI and confirm it completes successfully.

Impact of expiry

If the secret expires without updating Aqua, scans fail until a valid secret is configured. Plan rotation before expiration.

Setting Shorter Validity During Initial Onboarding

For new deployments, download the current CSPM onboarding script from Aqua documentation and use the documented --years flag during app registration when supported by your script version:

# Example pattern from onboarding script documentation
--years 1

Adjust the value to match organizational policy (for example 1 year for annual rotation).

Important Considerations

• Rotating the Azure secret does not change Aqua API keys; update each system independently.
• Legacy Aqua API keys may not support configurable validity; newer API key versions may—this is separate from CSPM Azure secrets.
• Include Azure subscription admins when planning rotation to avoid scan outages.

Verification and Monitoring

• Entra ID shows new secret with intended expiration
• Aqua cloud account connection test or manual scan succeeds
• No authentication errors in CSPM scan job logs after rotation

Platform Coverage

Related Resources

• Microsoft Entra ID — app credentials