Skip to main content
Apprentice
Nov 7, 2026 4:02 PM UTC
Question

Custom propagation setup for Azure Key Vaults

We have a custom propagation action that we have that is a Powershell script that when an EntraID password is rotated, it fires this action and updates the password in Azure Key Vault.  It works very well, however, everything has to be hard code.  For example, when userA has password rotated, on the parameters for the custom propagation action, we have ‘%p’ ‘%u’ ‘subscriptionid’ ‘keyvaultname’ on the command line.  It works great for this user and this key vault only.  We need to be able to pass subscriptionid and keyvault name dynamically via some variable if possible from the managed account properties.  I am not seeing a way to so that.  With only have a few options for parameter variables, it is making this a bit difficult.  Has anyone been able to over come the variable limitation and pass in variables from the managed account to the custom propagation scripts?  See the image attached for what I am talking about.  I changed the actual values to subid and vault to hide them.

 

I wish there was a variable that you can use for the description field as could put in the values needed there and parse in the script.  Just looking to see if anyone has found a way around this limitation.