Setting Up a Secret Rotation Reminder in Azure (and Where It Falls Short)

If you store a secret in Azure Key Vault with an expiration date set, you'd like something to remind you before that date arrives. Azure can do this. It's just more assembly than you'd expect, and the result has some sharp edges worth knowing about before you rely on it.

The build

The mechanism is Key Vault's near-expiry event, delivered through Event Grid.

1. Set an expiration date on the secret. Key Vault only raises a near-expiry event for secrets that have one. A secret with no expiry set is invisible to this entire process.
2. Create an Event Grid subscription on the Key Vault. Filter for the Microsoft.KeyVault.SecretNearExpiry event type.
3. Point it at something that notifies a human. A Logic App that sends an email, a Function that posts to Teams or Slack, a webhook into your incident tool — Event Grid just needs a handler. Event Grid can also send Key Vault events straight to an Azure Monitor alert, which notifies people through an action group.

Do that and you'll get a message roughly 30 days before each secret in that vault expires.

Where it falls short

It fires once, as far as the documentation goes. Microsoft documents SecretNearExpiry as triggered 30 days before the expiration date and says nothing about repeating it, so plan on a single notice. If that email lands during a vacation, gets caught by a filter, or goes to a distribution list nobody reads, there is no second reminder. The next signal you get is the secret actually expiring.

For secrets, thirty days is the only lead time you get. You can't ask Event Grid for a 90-day heads-up and a 60-day heads-up and a 30-day final warning. There's one notice, at one point.

It's per-vault. Every Key Vault needs its own Event Grid subscription and its own handler wiring. Three environments across four subscriptions is a dozen setups to build and keep working. Nothing tells you if one of them silently broke.

There's no overview. Even with every vault wired correctly, there's no single place that answers "what's expiring in the next quarter, across everything we own." You find out one event at a time.

Ten expiries in one week is ten separate emails. A quarterly rotation cycle where a batch of secrets was created together will come due together — and arrive as a burst of individual notifications with no summary.

What Vigil changes

Vigil is the aggregation layer over this. It finds the Key Vaults across your subscriptions using Azure Resource Graph, so you add vaults from a list instead of wiring each one into Event Grid, and it scans secrets, keys, and certificates on a schedule. Each vault you add still needs read access granted to Vigil's identity, but there is no per-vault event subscription or handler to build. You get staged thresholds (90, 60, and 30 days out by default, configurable), a single dashboard of days-until-expiry across every vault, and, on the Team plan and above, digest notifications so a cluster of expiries crossing a threshold on the same day is one summary instead of ten emails.

If you have one vault and a reliable inbox, the Event Grid build above is genuinely fine — and Vigil's Free tier covers that one vault if you'd rather not maintain it. The case for more than that starts when you can't say for certain which of your vaults has a working reminder and which doesn't.