Your data team just asked for credentials again. You dig through message history, remember that the secret expired last week, and sigh. There has to be a better way to connect Looker with Azure Key Vault and stop babysitting secrets by hand. There is, and it takes less time than getting another security exception approved.
Azure Key Vault keeps credentials encrypted, versioned, and permissioned in one place. Looker, built for analytics, needs those same credentials to query sources like Azure SQL or PostgreSQL. When you connect the two correctly, Looker pulls its secrets directly from Key Vault while your team never touches a password. Everyone wins, especially your auditors.
The integration flow revolves around identity. Azure’s Managed Identities or service principals authenticate Looker to the vault. Permissions are then handled through access policies or Azure RBAC roles. Once Looker can request a secret, you configure your connection string to reference that vault entry rather than a static password in its UI. No plaintext credentials, no last-minute scrambles before a demo.
How to connect Looker to Azure Key Vault
Create a managed identity for Looker. Grant it “get” permissions on the vault secrets it needs. Update your Looker database connection to call the Key Vault endpoint, using the managed identity as its auth context. From there, every time Looker runs a query, it retrieves the current credential on demand. Secret rotation happens automatically without anyone updating a dashboard config.
If it stops working, check two things: the identity’s role assignment and the application firewall on the vault. Ninety percent of failed integrations trace back to those settings. Rotate your secrets on a schedule, or better yet, with an event trigger from Azure Event Grid.