Cloud Discovery reads a secret from your Azure Key Vault when it runs a Microsoft Azure, Microsoft 365 / Entra ID, or Intune cloud action. You normally provide the key vault's standard address (https://<name>.vault.azure.net) as the Key Vault URI.
If your key vault is published through a reverse proxy or a web application firewall on your own domain, for example https://kv.mydomain.com, you can enter that address instead. When you do, Lansweeper shows a warning:
This Key Vault uses a custom domain instead of a standard *.vault.azure.net address, which Azure can't automatically verify as the genuine vault. Make sure this domain, and any proxy in front of it, is one you control and trust. This is a warning, not a blocker. You can still save.
Standard *.vault.azure.net addresses don't show this warning and continue to work unchanged.
Prerequisites
Before you use a custom-domain key vault address, set up your proxy or firewall so that:
- The custom domain presents a valid, publicly trusted TLS certificate.
- Requests are forwarded to your Azure Key Vault behind the proxy.
- The authentication challenge returned by the key vault is passed through unchanged. Your proxy must not remove or rewrite the authentication response header.
- The network path from Lansweeper to your endpoint is open.
These are settings in your own proxy and network. If any of them is missing, Cloud Discovery accepts the address but the connection still fails.
Enter the custom-domain address
- Create or edit a Microsoft Azure, Microsoft 365 / Entra ID, or Microsoft Intune cloud action.
- Enter the Tenant ID and Application ID as usual.
- In the Key Vault URI field, enter the full custom-domain address, including
https://. For example:https://kv.mydomain.com. As with a standard key vault, it must contain a secret named LansweeperSiteID that holds your Lansweeper Site ID. - Review the A security check will be skipped warning. It's expected for a custom domain and doesn't block you from saving.
- Validate the connection: select List subscriptions for a Microsoft Azure action, or Validate connection for a Microsoft 365 / Entra ID or Intune action. Then finish creating the action.
Permissions
Give the identity Lansweeper scans with only the access it needs to read the scanning secret. For the best security posture, use Azure role-based access control (RBAC):
- Assign the Key Vault Secrets User role to the scanning identity.
- Scope the assignment to the LansweeperSiteID secret only, not the whole key vault or subscription.
This lets Cloud Discovery read the one secret it needs and nothing else.
Restrict access to Lansweeper
For a tighter security posture, limit inbound connections so that only Lansweeper can reach your key vault. Because the key vault sits behind your proxy or web application firewall, apply this allowlist on that proxy, since it's the public entry point Lansweeper connects to.
Allow only the Lansweeper IP addresses for your region. The current list is in the Restrict Key Vault access section of Prepare Microsoft Cloud for Cloud Discovery.
Troubleshooting
| Message | Meaning | What to do |
|---|---|---|
| The address must start with HTTPS | The value doesn't begin with https:// |
Add https:// to the start of the address |
| The Key Vault URI is incorrect | The address is malformed or missing a host | Re-check the full address you entered |
| Failed to fetch secret from Azure Key Vault | The step was reached but the secret couldn't be read | Check your proxy setup: valid certificate, forwarding to the key vault, authentication header passed through unchanged, and an open firewall path |
| Insufficient permissions | The scanning identity can't read the secret | Grant it read access to the LansweeperSiteID secret |
If scanning still fails after the address is accepted and permissions are correct, the cause is almost always in the proxy, firewall, or certificate setup between Lansweeper and your key vault.