Azure Vault Explorer
Browse and edit Azure Key Vault secrets across all your tenants, subscriptions, and vaults — directly inside VS Code. No Azure Portal tab-switching required.
Features
Tenant → Subscription → Vault → Secrets tree
The sidebar panel mirrors the Azure Resources Explorer hierarchy — everything your account has access to, automatically discovered.
🏢 contoso.com
☁ Production
🔑 prod-keyvault (eastus · 12 secrets)
{} database-connection JSON
🔑 api-key
☁ Development
🔑 dev-keyvault
{} app-config JSON
Open and edit secrets in VS Code
Click any secret to open it in the editor.
- JSON secrets open as
.json with full syntax highlighting and validation
- Plain text secrets open as
.txt
- Press Ctrl+S / Cmd+S to save the secret back to Key Vault instantly
JSON is validated before saving — if the syntax is broken, the save is blocked and you see an error in the status bar.
Secret type indicators
| Icon |
Meaning |
{} blue |
JSON object secret |
| 🔑 yellow |
Plain text secret |
| ⊘ grey |
Secret is disabled in Key Vault |
Vault nodes show the secret count after expanding (e.g. my-keyvault-prod · 12 secrets).
Create a new secret
Right-click any vault → New Secret — enter the name and value. JSON values are automatically detected and stored with the correct content type.
Copy a secret value
Hover over a secret → click the clipboard icon, or right-click → Copy Secret Value.
Delete a secret
Right-click a secret → Delete Secret — a confirmation dialog prevents accidental deletes.
Certificate filtering
Certificate-backed secrets are hidden automatically — only regular secrets appear in the list.
Requirements
- VS Code 1.85 or later
- Azure CLI —
brew install azure-cli on macOS
- You must be signed in:
az login
- Get and List permissions on the Key Vaults you want to access
Getting started
- Install the extension
- Run
az login in a terminal
- Click the key icon in the VS Code activity bar
- Your tenants, subscriptions, and vaults appear automatically
Troubleshooting
| Symptom |
Fix |
| Panel shows "Sign in required" |
Click the sign-in button or run az login |
| 403 / Access denied on a vault |
Ask your admin to grant Get + List access |
| Secret saves but nothing restarts |
Pod restarts depend on your secrets sync setup (e.g. ESO + Reloader) — changes propagate on their next sync cycle |
| JSON shows parse error on open |
The value in Key Vault may have invisible Unicode characters. Overwrite it via CLI: az keyvault secret set --vault-name <vault> --name <name> --value '{"key":"value"}' |
Contributing
Issues and pull requests welcome. Source available at the publisher's repository.
