diff --git a/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts b/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts
index 7363e18b2..039033fe6 100644
--- a/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts
+++ b/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts
@@ -46,7 +46,8 @@ export const azureClientSecretRotationFactory: TRotationFactory<
         endpoint,
         {
           passwordCredential: {
-            displayName: `Infisical Rotated Secret (${formattedDate})`
+            displayName: `Infisical Rotated Secret (${formattedDate})`,
+            endDateTime: "2299-12-31T23:59:59Z" // effectively no expiration
           }
         },
         {
diff --git a/backend/src/services/app-connection/azure-client-secrets/azure-client-secrets-connection-fns.ts b/backend/src/services/app-connection/azure-client-secrets/azure-client-secrets-connection-fns.ts
index be07a33a0..830cbbec3 100644
--- a/backend/src/services/app-connection/azure-client-secrets/azure-client-secrets-connection-fns.ts
+++ b/backend/src/services/app-connection/azure-client-secrets/azure-client-secrets-connection-fns.ts
@@ -127,7 +127,7 @@ export const validateAzureClientSecretsConnectionCredentials = async (config: TA
         scope: `openid offline_access https://graph.microsoft.com/.default`,
         client_id: INF_APP_CONNECTION_AZURE_CLIENT_ID,
         client_secret: INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
-        redirect_uri: `${SITE_URL}/organization/app-connections/azure-client-secrets/oauth/callback`
+        redirect_uri: `${SITE_URL}/organization/app-connections/azure/oauth/callback`
       })
     );
   } catch (e: unknown) {
diff --git a/docs/images/app-connections/azure/client-secrets/create-oauth-method.png b/docs/images/app-connections/azure/client-secrets/create-oauth-method.png
index ae02705d6..e38707ea1 100644
Binary files a/docs/images/app-connections/azure/client-secrets/create-oauth-method.png and b/docs/images/app-connections/azure/client-secrets/create-oauth-method.png differ
diff --git a/docs/integrations/app-connections/azure-client-secrets.mdx b/docs/integrations/app-connections/azure-client-secrets.mdx
index 7e50348d2..dd91205f5 100644
--- a/docs/integrations/app-connections/azure-client-secrets.mdx
+++ b/docs/integrations/app-connections/azure-client-secrets.mdx
@@ -23,7 +23,7 @@ Infisical currently only supports one method for connecting to Azure, which is O
       ![Azure client secrets](/images/integrations/azure-app-configuration/config-aad.png)
       ![Azure client secrets](/images/integrations/azure-app-configuration/config-new-app.png)
 
-      Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/organization/app-connections/azure-client-secrets/oauth/callback`.
+      Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/organization/app-connections/azure/oauth/callback`.
       <Tip>
         The domain you defined in the Redirect URI should be equivalent to the `SITE_URL` configured in your Infisical instance.
       </Tip>
@@ -36,13 +36,20 @@ Infisical currently only supports one method for connecting to Azure, which is O
 
       #### Azure Client Secrets permissions
     
-      Set the API permissions of the Azure application to include the following Azure Client Secrets permissions: `Application.ReadWrite.All`.
+      Set the API permissions of the Azure application to include the following Azure Client Secrets permissions: 
+        - Microsoft Graph
+          - `Application.ReadWrite.All`
+        - Azure App Configuration
+          - `KeyValue.Delete`
+          - `KeyValue.Read`
+          - `KeyValue.Write`
+
       ![Azure client secrets](/images/integrations/azure-client-secrets/app-api-permissions.png)
 
 
     </Step>
     <Step title="Add your application credentials to Infisical">
-      Obtain the **Application (Client) ID** and **Directory (Tenant) ID** in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.
+      Obtain the **Application (Client) ID** and **Directory (Tenant) ID** (this will be used later in the Infisical connection) in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.
 
       ![Azure client secrets](../../images/app-connections/azure/client-secrets/config-credentials-1.png)
       ![Azure client secrets](../../images/integrations/azure-app-configuration/config-credentials-2.png)
@@ -70,7 +77,7 @@ Infisical currently only supports one method for connecting to Azure, which is O
 		Select the **Azure Connection** option from the connection options modal. ![Select Azure Connection](/images/app-connections/azure/client-secrets/select-connection.png)
 	</Step>
 	<Step title="Authorize Connection">
-    You can optionally authenticate against a specific tenant by providing the Azure Tenant or Directory ID.
+    Fill in the **Tenant ID** field with the Directory (Tenant) ID you obtained in the previous step.
 
     Now select the **OAuth** method and click **Connect to Azure**. 
 
diff --git a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureClientSecretsConnectionForm.tsx b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureClientSecretsConnectionForm.tsx
index 4b7071f61..9076c95ce 100644
--- a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureClientSecretsConnectionForm.tsx
+++ b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureClientSecretsConnectionForm.tsx
@@ -27,7 +27,7 @@ type Props = {
 const formSchema = genericAppConnectionFieldsSchema.extend({
   app: z.literal(AppConnection.AzureClientSecrets),
   method: z.nativeEnum(AzureClientSecretsConnectionMethod),
-  tenantId: z.string().trim()
+  tenantId: z.string().trim().min(1, "Tenant ID is required")
 });
 
 type FormData = z.infer<typeof formSchema>;
@@ -75,7 +75,7 @@ export const AzureClientSecretsConnectionForm = ({ appConnection }: Props) => {
     switch (formData.method) {
       case AzureClientSecretsConnectionMethod.OAuth:
         window.location.assign(
-          `https://login.microsoftonline.com/${formData.tenantId || "common"}/oauth2/v2.0/authorize?client_id=${oauthClientId}&response_type=code&redirect_uri=${window.location.origin}/organization/app-connections/azure-client-secrets/oauth/callback&response_mode=query&scope=https://azconfig.io/.default%20openid%20offline_access&state=${state}<:>azure-client-secrets`
+          `https://login.microsoftonline.com/${formData.tenantId || "common"}/oauth2/v2.0/authorize?client_id=${oauthClientId}&response_type=code&redirect_uri=${window.location.origin}/organization/app-connections/azure/oauth/callback&response_mode=query&scope=https://azconfig.io/.default%20openid%20offline_access&state=${state}<:>azure-client-secrets`
         );
         break;
       default:
@@ -97,7 +97,7 @@ export const AzureClientSecretsConnectionForm = ({ appConnection }: Props) => {
           control={control}
           render={({ field, fieldState: { error } }) => (
             <FormControl
-              tooltipText="The Active Directory (Entra ID) Tenant ID."
+              tooltipText="The Directory (tenant) ID."
               isError={Boolean(error?.message)}
               label="Tenant ID"
               errorText={error?.message}