> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/rotate-key.md).

# Rotate Key

Rotate cryptographic keys in Azure Key Vault.

Rotates cryptographic keys in Azure Key Vault by creating a new key version. The action targets one or more named keys in a specified vault and runs rotations concurrently (up to five keys in parallel). Each key's result is reported individually, so partial success is possible.

{% hint style="info" %}
**NHI feature**: ROTATE\_KEY is part of Veza's Non-Human Identity (NHI) management capabilities. Veza Support enables key rotation for your tenant. It does not require an LCM license. This action is not offered in the policy editor. To rotate a key manually, use the **Rotate Key** action on a key entity's row in **NHI Security → Keys & Secrets**.
{% endhint %}

| Setting     | Description                                                                                              |
| ----------- | -------------------------------------------------------------------------------------------------------- |
| Data Source | The Azure Key Vault datasource providing credentials for the vault                                       |
| Vault Name  | Name of the Azure Key Vault (3-24 characters, alphanumeric and hyphens, must start and end alphanumeric) |
| Key Names   | One or more key names to rotate. Each key gets a new version; the previous version is not deleted        |

**Supported Integrations:**

| Integration     | Notes                                                                                       |
| --------------- | ------------------------------------------------------------------------------------------- |
| Azure Key Vault | Only supported provider. Requires an Azure datasource configured with Key Vault permissions |

## Required Azure permissions

The Veza app registration must have the `rotate` operation on the target Key Vault. The `List` permission used for extraction is not sufficient. Grant the rotation permission using the model the vault uses:

* **RBAC model (recommended)**: Assign the **Key Vault Crypto Officer** role to the Veza app registration on the target vault. This role includes the `keys/rotate` permission.
* **Access policy model (legacy)**: Under Key Permissions, add **Rotate**, **Get Rotation Policy**, and **Set Rotation Policy**.

Microsoft recommends RBAC over access policies for new vault deployments. See [Azure RBAC versus access policies](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy) and the [Azure Key Vault integration](/4yItIzMvkpAvMVFAamTf/integrations/integrations/azure.md#7-add-key-vault-permissions-optional).

## Where rotations are recorded

Each Rotate Key run appears on the [Provisioning Activity](/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/getting-started/activity-log.md) page: the run as a job on the **Integration Jobs** tab, and each key's result as an event on the **Events** tab. These records have no associated identity, so only users with the **Administrator** or **Operator** role can see them.

## Result placeholders (for notification templates)

| Placeholder             | Description                         |
| ----------------------- | ----------------------------------- |
| `{{ROTATED_KEY_COUNT}}` | Count of keys successfully rotated  |
| `{{FAILED_KEY_COUNT}}`  | Count of keys that failed to rotate |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/lifecycle-management/policies-workflows/actions/rotate-key.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.