---
title: "Azure Key Vault behind a custom domain | Lansweeper Platform"
slug: "azure-key-vault-behind-a-custom-domain"
description: "Connect Cloud Discovery to an Azure Key Vault behind a reverse proxy or WAF on a custom domain. Set up the proxy, enter the custom URI, and restrict access."
status: "update"
updated: 2026-09-02T12:28:57Z
published: 2026-09-02T12:28:57Z
canonical: "docs.lansweeper.com/azure-key-vault-behind-a-custom-domain"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lansweeper.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use an Azure Key Vault behind a custom domain

Cloud Discovery reads a secret from your Azure Key Vault when it runs a Microsoft Azure, Microsoft 365 / Entra ID, or Intune cloud action. You normally provide the key vault's standard address (`https://<name>.vault.azure.net`) as the **Key Vault URI**.

If your key vault is published through a reverse proxy or a web application firewall on your own domain, for example `https://kv.mydomain.com`, you can enter that address instead. When you do, Lansweeper shows a warning:

              A security check will be skipped

              

This Key Vault uses a custom domain instead of a standard `*.vault.azure.net` address, which Azure can't automatically verify as the genuine vault. Make sure this domain, and any proxy in front of it, is one you control and trust. This is a warning, not a blocker. You can still save.

              Standard addresses are unaffected

              

Standard `*.vault.azure.net` addresses don't show this warning and continue to work unchanged.

## Prerequisites

Before you use a custom-domain key vault address, set up your proxy or firewall so that:

- The custom domain presents a valid, publicly trusted TLS certificate.
- Requests are forwarded to your Azure Key Vault behind the proxy.
- The authentication challenge returned by the key vault is passed through unchanged. Your proxy must not remove or rewrite the authentication response header.
- The network path from Lansweeper to your endpoint is open.

              A misconfigured proxy still fails

              

These are settings in your own proxy and network. If any of them is missing, Cloud Discovery accepts the address but the connection still fails.

## Enter the custom-domain address

1. Create or edit a [Microsoft Azure](/docs/create-a-cloud-action-microsoft-azure), [Microsoft 365 / Entra ID](/docs/create-a-cloud-action-microsoft-365entra-id), or [Microsoft Intune](/docs/create-a-cloud-action-microsoft-intune) cloud action.
2. Enter the **Tenant ID** and **Application ID** as usual.
3. In the **Key Vault URI** field, enter the full custom-domain address, including `https://`. For example: `https://kv.mydomain.com`. As with a standard key vault, it must contain a secret named **LansweeperSiteID** that holds your Lansweeper Site ID.
4. Review the **A security check will be skipped** warning. It's expected for a custom domain and doesn't block you from saving.
5. Validate the connection: select **List subscriptions** for a Microsoft Azure action, or **Validate connection** for a Microsoft 365 / Entra ID or Intune action. Then finish creating the action.

## Permissions

Give the identity Lansweeper scans with only the access it needs to read the scanning secret. For the best security posture, use Azure role-based access control (RBAC):

- Assign the **Key Vault Secrets User** role to the scanning identity.
- Scope the assignment to the **LansweeperSiteID** secret only, not the whole key vault or subscription.

This lets Cloud Discovery read the one secret it needs and nothing else.

## Restrict access to Lansweeper

For a tighter security posture, limit inbound connections so that only Lansweeper can reach your key vault. Because the key vault sits behind your proxy or web application firewall, apply this allowlist on that proxy, since it's the public entry point Lansweeper connects to.

Allow only the Lansweeper IP addresses for your region. The current list is in the **Restrict Key Vault access** section of [Prepare Microsoft Cloud for Cloud Discovery](/docs/prepare-microsoft-azure-for-cloud-discovery).

## Troubleshooting

| Message | Meaning | What to do |
| --- | --- | --- |
| The address must start with HTTPS | The value doesn't begin with `https://` | Add `https://` to the start of the address |
| The Key Vault URI is incorrect | The address is malformed or missing a host | Re-check the full address you entered |
| Failed to fetch secret from Azure Key Vault | The step was reached but the secret couldn't be read | Check your proxy setup: valid certificate, forwarding to the key vault, authentication header passed through unchanged, and an open firewall path |
| Insufficient permissions | The scanning identity can't read the secret | Grant it read access to the **LansweeperSiteID** secret |

              Still failing after everything checks out?

              

If scanning still fails after the address is accepted and permissions are correct, the cause is almost always in the proxy, firewall, or certificate setup between Lansweeper and your key vault.