SaaS
Microsoft Azure
Microsoft is retiring the Azure Key Vault Secrets Provider Extension for Azure Arc-enabled Kubernetes clusters on 9 October 2027; the replacement is the Azure Key Vault Secret Store Extension.
departs 9 Oct 2027
Quick answers
- Is it true that Azure Key Vault Secrets Provider Extension for Arc-enabled Kubernetes retires 9 October 2027 — migrate to the Key Vault Secret Store Extension?
- Yes. Microsoft Azure has officially announced it, effective 9 Oct 2027. If your Azure Arc-enabled Kubernetes clusters sync secrets from Azure Key Vault using the Azure Key Vault Secrets Provider Extension (the Arc-enabled version of the Secrets Store CSI Driver provider, extension type `Microsoft.AzureKeyVaultSecretsProvider`), that extension is retired on 9 October 2027.
- When does it take effect?
- 9 Oct 2027. Verified against the vendor's own announcement.
- What should I use instead?
- Move to the Azure Key Vault Secret Store Extension, which Microsoft positions as the direct successor with equivalent secret-access and synchronization functionality for Azure Arc-enabled Kubernetes workloads, plus two capabilities the old extension lacks: offline access to secrets, and authentication via workload identity federation — so applications reach Key Vault without long-lived credentials stored on the cluster, which also closes the credential-on-cluster exposure the Secrets Provider extension left open.
What this means for you
If your Azure Arc-enabled Kubernetes clusters sync secrets from Azure Key Vault using the Azure Key Vault Secrets Provider Extension (the Arc-enabled version of the Secrets Store CSI Driver provider, extension type `Microsoft.AzureKeyVaultSecretsProvider`), that extension is retired on 9 October 2027. After retirement it receives no new features, bug fixes, security updates, or technical support. This affects the Arc-enabled Kubernetes flavor only — the same-named Secrets Provider add-on on managed Azure Kubernetes Service (AKS) is a separate product and is not covered by this notice, so check which one your clusters actually run before acting. The cutoff is more than a security-update story: once the extension stops receiving CVE fixes, a component that holds the path between your clusters and your secrets becomes a standing liability, so this is a migration to schedule well ahead of the date rather than defer to 2027.
Where to go
Move to the Azure Key Vault Secret Store Extension, which Microsoft positions as the direct successor with equivalent secret-access and synchronization functionality for Azure Arc-enabled Kubernetes workloads, plus two capabilities the old extension lacks: offline access to secrets, and authentication via workload identity federation — so applications reach Key Vault without long-lived credentials stored on the cluster, which also closes the credential-on-cluster exposure the Secrets Provider extension left open. Microsoft publishes migration guidance for transitioning workloads and configurations ahead of retirement. Practically: inventory which Arc-enabled clusters have the `Microsoft.AzureKeyVaultSecretsProvider` extension installed, stand up the Secret Store Extension alongside it, re-point your SecretProviderClass / secret-sync configuration, validate that pods still mount the expected secrets, then remove the old extension. Do not wait for 2027 — workload identity federation is a configuration change (federated credentials, no more cluster-stored secrets) worth making on its own merits.
- Azure Key Vault Secret Store Extension — Microsoft's named successor for Arc-enabled Kubernetes; equivalent secret sync plus offline access and workload identity federation
Microsoft is retiring the Azure Key Vault Secrets Provider Extension for Azure Arc-enabled Kubernetes clusters on 9 October 2027. The replacement is the Azure Key Vault Secret Store Extension, which Microsoft describes as providing equivalent secret-access and synchronization for Arc-enabled Kubernetes workloads.
What is being retired
The Azure Key Vault Secrets Provider Extension is the Azure Arc-enabled Kubernetes packaging of the Secrets Store CSI Driver’s Key Vault provider — the component that lets pods on an Arc-connected cluster mount and synchronize secrets, keys, and certificates out of Azure Key Vault. Its extension type is Microsoft.AzureKeyVaultSecretsProvider. After 9 October 2027 it receives no new features, bug fixes, security updates, or technical support.
One boundary matters: this notice is about the Azure Arc-enabled Kubernetes extension. The identically-named Secrets Provider add-on on managed AKS is a separate product and is not covered here. Confirm which your clusters run before you plan anything — the extension type string is the same in both places, which is exactly why there is no machine-detectable fingerprint on this entry.
Why migrate before the date
A secret-syncing component that stops getting security updates sits on the path between your clusters and your Key Vault. Running it unpatched past retirement is a standing risk, not a cosmetic one — so treat 9 October 2027 as the far edge of a migration window, not the day to start.
Migrate to the Secret Store Extension
Microsoft’s named successor is the Azure Key Vault Secret Store Extension, with equivalent functionality plus two additions:
- Offline access to secrets.
- Authentication using workload identity federation — applications reach Key Vault without long-lived credentials stored on the cluster, closing the credential-on-cluster exposure the older extension left open.
Microsoft publishes migration guidance for moving workloads and configurations across. A practical order:
- Inventory which Arc-enabled clusters have
Microsoft.AzureKeyVaultSecretsProviderinstalled. - Install the Secret Store Extension alongside it.
- Re-point your
SecretProviderClass/ secret-sync configuration. - Validate that pods still mount the expected secrets.
- Remove the old extension.
Workload identity federation is worth adopting on its own — it removes cluster-stored credentials regardless of the retirement deadline.
Entry changelog
- — last reviewed.
- — Entry created from Microsoft's Azure Updates retirement notice (id 570313), verified against the Microsoft release-communications API (https://www.microsoft.com/releasecommunications/api/v2/azure/570313), which gives the retirement date (9 October 2027), the named successor (Azure Key Vault Secret Store Extension), the post-retirement loss of features/fixes/security updates/support, and the successor's added offline-access and workload-identity-federation capabilities. Surfaced by the azure-updates Layer-1 adapter. No detect: fingerprint — the extension-type string `Microsoft.AzureKeyVaultSecretsProvider` is shared with the AKS Secrets Provider add-on, which is not being retired, so a text fingerprint would false-positive on unaffected clusters.
Put this countdown in your README
Building on Microsoft Azure? Drop this badge into a project’s README or docs — it shows the days left and
refreshes on its own every night from this page. 
[](https://lastcall.dev/entries/azure-key-vault-secrets-provider-extension-arc-retirement)Spot an error or a changed date? Tell us and it’s corrected the same night.