Bring Your Own Key for Microsoft Azure Key Vault and Entrust KeyControl: Integration Guide

This guide describes how to configure the Entrust KeyControl server as a KMS in Azure BYOK.

To install and configure the Entrust KeyControl server see KeyControl Installation and Upgrade Guide .

Also refer to the documentation and set-up process for Microsoft Azure BYOK in the Microsoft Azure Key Vault online documentation .

Entrust has successfully tested the integration of KeyControl with Azure BYOK in the following configurations:

Entrust has successfully tested the following features:

Follow the installation and set-up instructions in KeyControl Installation and Upgrade Guide .

Once KeyControl is set up, you can continue with the integration.

To create and configure an Azure Key Vault application:

1. Create an Azure Key Vault application. For example:

2. Set the permissions for the BYOK service application. To do, this, open the Access Policies and select All in Key Permissions , Secrets Permissions , and Certificate Permissions . For example:

3. Select Home > Subscriptions and then select your subscription.

4. In Access control (IAM) , select the Role assignments tab.

5. Select the Reader role.

   Note	The Owner permission of the subscription is required to perform this operation. For example:

See the following link for additional information Creating a service principal .

To register the Azure Key Vault application:

1. Navigate to Azure Active Directory > App Registrations .

2. Select New registration .

   The Register an application page appears.

3. Create the BYOK service application with the following parameters:

   • For Name , enter azurebyokkeycontrol .

   • For Supported account types , select Accounts in this organizational directory only (Entrust only - Single tenant) .

     For example:

4. Select Register .

5. Navigate to Azure Active Directory > App Registrations > azurebyokkeycontrol > API permissions .

6. Select Add a permission and add the following permissions:

   1. For Azure Key Vault , select Delegated permissions and select user-impersonation . For example:

   2. For Azure Service Management , select Delegate permissions and select user-impersonation .

   3. For Microsoft Graph , select Delegate permissions and select both User.Read and Application.ReadWrite.All .

7. Select Add permissions .

   The permissions update. For example:

See the following link for additional information Creating a service application in Azure Portal .

To create an Azure client secret:

1. Navigate to Home > Azure Active Directory > App registrations > azurebyokkeycontrol > Certificates & secrets .

2. Select New client secret .

3. Add the Description and the date on which the secret Expires . The recommended period is 24 months. For example:

   Note	You must update the secret key in KeyControl before the expiration date to ensure uninterrupted access to Azure Key vaults.

4. Copy the Value of the new client secret.

   Note	This value appears in Azure Portal only temporarily. When the portal hides the client secret, it cannot be retrieved and a new secret will need to be created.

See the following link for additional information Creating a client secret in Azure Active Directory .

To set Azure Key Vault permissions for BYOK:

1. Navigate to Home > Key vault > azure-byok-keycontrol > Access policies .

2. Select Add access policy .

   The Add access policy dialog appears.

3. In the Add access policy dialog:

   1. For Key permissions , select All .

   2. For Secret permissions , select All .

   3. For Certificate permissions , select All .

   4. For Select principal , add azurebyokkeycontrol .

   For example:

4. Select Add .

   The permissions update. For example:

See the following link for additional information Set permission for the BYOK service by configuring each Azure Key Vault .

To create an Azure CSP account:

1. Navigate to Home > Azure Active Directory > App registrations > azurebyokkeycontrol .

2. Save the following:

   • Application (client) ID

   • Directory (tenant) ID

3. Select Home > Subscriptions and then select your subscription.

4. Save the following:

   • Subscription ID

See the following link for additional information Creating a CSP account in Azure .

To create a key set in KeyControl:

1. In KeyControl, select BYOK on the main toolbar.

2. Select the Key Sets tab.

3. Select Actions > Create Key Set .

   The Create Key Set dialog appears.

4. Enter a Name and Description for the key set. For example:

5. Select Continue .

6. Select the CSP Account tab.

7. If no accounts exist, select Add CSP Account .

   The Add CSP Account dialog appears.

8. In the Details tab, enter the information saved during the Create an Azure CSP account process. For example:

9. Select Apply .

10. In the CSP Account tab, select the new CSP account. For example:

11. Select Continue .

12. In the HSM tab, check if an HSM is configured. For example:

    If no HSM is configured, configure one before enabling it in this dialog.

13. Select Continue .

14. In the Schedule tab, select a Rotation Schedule matching the selection made during Create an Azure client secret . For example:

15. Select Apply .

    The key set is added. For example:

16. Verify the Azure Key Vault setting Accessible is set to Yes . For example:

For additional information, see Creating a Key Set .

To create a cloud key:

1. In KeyControl, select BYOK on the toolbar.

2. Select the CloudKeys tab.

3. Select the Key Set and Key Vault . For example:

4. Select Actions > Create CloudKey .

   The Create CloudKey dialog appears.

5. In the Details tab, enter the Name and Description . For example:

6. Select Continue .

7. In the Access tab, select the required Cipher . For example:

8. Select Continue .

9. In the Schedule tab:

   1. Select a Rotation Schedule .

   2. Set an Activation Date .

   3. Set Expiration .

   For example:

10. Select Continue .

    The cloud key is created.

11. Verify the cloud key is visible in Azure key vault.

See the following link for additional information Creating a CloudKey .

To create a cloud key in Azure Key Vault:

1. Navigate to Home > Key vaults > azure-byok-keycontrol > Keys > Generate/Import .

   The Create a key dialog appears.

2. Enter the Name and select all that applies. For example:

3. Select Create .

   The cloud key is created.

4. Verify the newly created key. For example:

Import the cloud key in KeyControl:

1. Select BYOK on the toolbar.

2. Select the Key Sets tab and select azurebyokkeycontrol .

3. Select Actions > Import CloudKey .

   The Import Cloud Keys dialog appears.

4. Select a Key Vault . For example:

5. Select Import .

   The key is imported.

6. Select the CloudKeys tab and select Refresh .

7. Verify the imported key. For example:

To remove a cloud key in KeyControl:

1. In KeyControl, select BYOK on the main toolbar.

2. Select the CloudKeys tab.

3. Select the key to the removed. For example, azurebyokkeycontrol-createdInKeyControl .

4. Select Actions > Remove from Cloud .

   The Remove from Cloud dialog appears.

5. Type the name of the key in Type CloudKey Name . For example:

6. Select Remove .

   The cloud key is removed from KeyControl. Its Cloud Status becomes NOT AVAILABLE . For example:

7. Verify the key is gone in Azure. For example:

For additional information, see Removing a CloudKey from the Cloud .

To delete a cloud key in KeyControl:

1. In KeyControl, select BYOK on the toolbar.

2. Select the CloudKeys tab.

3. Select the key to the removed. For example, azurebyokkeycontrol-createdInKeyControl .

4. Select Actions > Delete CloudKey .

   The Delete CloudKey dialog appears.

5. Select a time in Define when the CloudKey should be permanently deleted . For example:

6. Select Delete .

   The cloud key is deleted from KeyControl. The Cloud Status becomes PENDING DELETE . For example:

7. Verify the key is gone in Azure. For example:

For additional information, see Deleting a CloudKey .

To cancel a cloud key deletion in KeyControl:

1. In KeyControl, select BYOK on the toolbar.

2. Select the CloudKeys tab.

3. Select the key for which you want to cancel a deletion. For example, azurebyokkeycontrol-createdInAzure .

4. Select Actions > Cancel Deletion .

   The Cancel Deletion dialog appears. For example:

5. Select Cancel Delete .

   The deletion is cancelled.

6. Verify the status change in KeyControl. For example:

7. Verify the key is now available in Azure. For example:

For additional information, see Canceling a CloudKey Deletion .

To rotate a cloud key in KeyControl:

1. In KeyControl, select BYOK on the toolbar.

2. Select the CloudKeys tab.

3. Select the key you want to rotate. Then, scroll down until you see the Rotate Now control. For example:

4. Select Rotate Now .

   The key is rotated.

5. In Azure, navigate to Home > Key vaults > azure-byok-keycontrol > Keys > Key Name .

6. Verify that the key has been rotated. For example: