requested changes

backend/src/server/routes/v1/app-connection-routers/app-connection-endpoints.ts

@@ -8,7 +8,6 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
 import { TAppConnection, TAppConnectionInput } from "@app/services/app-connection/app-connection-types";
-import { AzureResources } from "@app/services/app-connection/azure";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerAppConnectionEndpoints = <T extends TAppConnection, I extends TAppConnectionInput>({
@@ -78,8 +77,7 @@ export const registerAppConnectionEndpoints = <T extends TAppConnection, I exten
             .object({
               app: z.literal(app),
               name: z.string(),
-              id: z.string().uuid(),
+              id: z.string().uuid()
-              azureResource: z.nativeEnum(AzureResources).optional()
             })
             .array()
         })

backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts

@@ -4,7 +4,14 @@ import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { readLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AwsConnectionListItemSchema, SanitizedAwsConnectionSchema } from "@app/services/app-connection/aws";
-import { AzureConnectionListItemSchema, SanitizedAzureConnectionSchema } from "@app/services/app-connection/azure";
+import {
+  AzureAppConfigurationConnectionListItemSchema,
+  SanitizedAzureAppConfigurationConnectionSchema
+} from "@app/services/app-connection/azure-app-configuration";
+import {
+  AzureKeyVaultConnectionListItemSchema,
+  SanitizedAzureKeyVaultConnectionSchema
+} from "@app/services/app-connection/azure-key-vault";
 import { GcpConnectionListItemSchema, SanitizedGcpConnectionSchema } from "@app/services/app-connection/gcp";
 import { GitHubConnectionListItemSchema, SanitizedGitHubConnectionSchema } from "@app/services/app-connection/github";
 import { AuthMode } from "@app/services/auth/auth-type";
@@ -14,14 +21,16 @@ const SanitizedAppConnectionSchema = z.union([
   ...SanitizedAwsConnectionSchema.options,
   ...SanitizedGitHubConnectionSchema.options,
   ...SanitizedGcpConnectionSchema.options,
-  ...SanitizedAzureConnectionSchema.options
+  ...SanitizedAzureKeyVaultConnectionSchema.options,
+  ...SanitizedAzureAppConfigurationConnectionSchema.options
 ]);
 
 const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
   AwsConnectionListItemSchema,
   GitHubConnectionListItemSchema,
   GcpConnectionListItemSchema,
-  AzureConnectionListItemSchema
+  AzureKeyVaultConnectionListItemSchema,
+  AzureAppConfigurationConnectionListItemSchema
 ]);
 
 export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {

backend/src/server/routes/v1/app-connection-routers/azure-app-configuration-connection-router.ts

@@ -0,0 +1,18 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateAzureAppConfigurationConnectionSchema,
+  SanitizedAzureAppConfigurationConnectionSchema,
+  UpdateAzureAppConfigurationConnectionSchema
+} from "@app/services/app-connection/azure-app-configuration";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerAzureAppConfigurationConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.AzureAppConfiguration,
+    server,
+    sanitizedResponseSchema: SanitizedAzureAppConfigurationConnectionSchema,
+    createSchema: CreateAzureAppConfigurationConnectionSchema,
+    updateSchema: UpdateAzureAppConfigurationConnectionSchema
+  });
+};

backend/src/server/routes/v1/app-connection-routers/azure-connection-router.ts

@@ -1,18 +0,0 @@
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  CreateAzureConnectionSchema,
-  SanitizedAzureConnectionSchema,
-  UpdateAzureConnectionSchema
-} from "@app/services/app-connection/azure";
-
-import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
-
-export const registerAzureConnectionRouter = async (server: FastifyZodProvider) => {
-  registerAppConnectionEndpoints({
-    app: AppConnection.Azure,
-    server,
-    sanitizedResponseSchema: SanitizedAzureConnectionSchema,
-    createSchema: CreateAzureConnectionSchema,
-    updateSchema: UpdateAzureConnectionSchema
-  });
-};

backend/src/server/routes/v1/app-connection-routers/azure-key-vault-connection-router.ts

@@ -0,0 +1,18 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateAzureKeyVaultConnectionSchema,
+  SanitizedAzureKeyVaultConnectionSchema,
+  UpdateAzureKeyVaultConnectionSchema
+} from "@app/services/app-connection/azure-key-vault";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerAzureKeyVaultConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.AzureKeyVault,
+    server,
+    sanitizedResponseSchema: SanitizedAzureKeyVaultConnectionSchema,
+    createSchema: CreateAzureKeyVaultConnectionSchema,
+    updateSchema: UpdateAzureKeyVaultConnectionSchema
+  });
+};

backend/src/server/routes/v1/app-connection-routers/index.ts

@@ -1,7 +1,8 @@
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 
 import { registerAwsConnectionRouter } from "./aws-connection-router";
-import { registerAzureConnectionRouter } from "./azure-connection-router";
+import { registerAzureAppConfigurationConnectionRouter } from "./azure-app-configuration-connection-router";
+import { registerAzureKeyVaultConnectionRouter } from "./azure-key-vault-connection-router";
 import { registerGcpConnectionRouter } from "./gcp-connection-router";
 import { registerGitHubConnectionRouter } from "./github-connection-router";
 
@@ -12,5 +13,6 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
     [AppConnection.AWS]: registerAwsConnectionRouter,
     [AppConnection.GitHub]: registerGitHubConnectionRouter,
     [AppConnection.GCP]: registerGcpConnectionRouter,
-    [AppConnection.Azure]: registerAzureConnectionRouter
+    [AppConnection.AzureKeyVault]: registerAzureKeyVaultConnectionRouter,
+    [AppConnection.AzureAppConfiguration]: registerAzureAppConfigurationConnectionRouter
   };

backend/src/services/app-connection/app-connection-enums.ts

@@ -2,7 +2,8 @@ export enum AppConnection {
   GitHub = "github",
   AWS = "aws",
   GCP = "gcp",
-  Azure = "azure"
+  AzureKeyVault = "azure-key-vault",
+  AzureAppConfiguration = "azure-app-configuration"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -20,14 +20,24 @@ import {
 } from "@app/services/app-connection/github";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
-import { AzureConnectionMethod, getAzureConnectionListItem, validateAzureConnectionCredentials } from "./azure";
+import {
+  AzureAppConfigurationConnectionMethod,
+  getAzureAppConfigurationConnectionListItem,
+  validateAzureAppConfigurationConnectionCredentials
+} from "./azure-app-configuration";
+import {
+  AzureKeyVaultConnectionMethod,
+  getAzureKeyVaultConnectionListItem,
+  validateAzureKeyVaultConnectionCredentials
+} from "./azure-key-vault";
 
 export const listAppConnectionOptions = () => {
   return [
     getAwsAppConnectionListItem(),
     getGitHubConnectionListItem(),
     getGcpAppConnectionListItem(),
-    getAzureConnectionListItem()
+    getAzureKeyVaultConnectionListItem(),
+    getAzureAppConfigurationConnectionListItem()
   ].sort((a, b) => a.name.localeCompare(b.name));
 };
 
@@ -84,8 +94,10 @@ export const validateAppConnectionCredentials = async (
       return validateGitHubConnectionCredentials(appConnection);
     case AppConnection.GCP:
       return validateGcpConnectionCredentials(appConnection);
-    case AppConnection.Azure:
+    case AppConnection.AzureKeyVault:
-      return validateAzureConnectionCredentials(appConnection);
+      return validateAzureKeyVaultConnectionCredentials(appConnection);
+    case AppConnection.AzureAppConfiguration:
+      return validateAzureAppConfigurationConnectionCredentials(appConnection);
     default:
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
       throw new Error(`Unhandled App Connection ${app}`);
@@ -96,7 +108,8 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
   switch (method) {
     case GitHubConnectionMethod.App:
       return "GitHub App";
-    case AzureConnectionMethod.OAuth:
+    case AzureKeyVaultConnectionMethod.OAuth:
+    case AzureAppConfigurationConnectionMethod.OAuth:
     case GitHubConnectionMethod.OAuth:
       return "OAuth";
     case AwsConnectionMethod.AccessKey:

backend/src/services/app-connection/app-connection-maps.ts

@@ -4,5 +4,6 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.AWS]: "AWS",
   [AppConnection.GitHub]: "GitHub",
   [AppConnection.GCP]: "GCP",
-  [AppConnection.Azure]: "Azure"
+  [AppConnection.AzureKeyVault]: "Azure Key Vault",
+  [AppConnection.AzureAppConfiguration]: "Azure App Configuration"
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -27,9 +27,8 @@ import { ValidateGitHubConnectionCredentialsSchema } from "@app/services/app-con
 import { githubConnectionService } from "@app/services/app-connection/github/github-connection-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
-import { KmsDataKey } from "../kms/kms-types";
 import { TAppConnectionDALFactory } from "./app-connection-dal";
-import { AzureResources } from "./azure";
+import { ValidateAzureKeyVaultConnectionCredentialsSchema } from "./azure-key-vault";
 import { ValidateGcpConnectionCredentialsSchema } from "./gcp";
 import { gcpConnectionService } from "./gcp/gcp-connection-service";
 
@@ -45,7 +44,8 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.AWS]: ValidateAwsConnectionCredentialsSchema,
   [AppConnection.GitHub]: ValidateGitHubConnectionCredentialsSchema,
   [AppConnection.GCP]: ValidateGcpConnectionCredentialsSchema,
-  [AppConnection.Azure]: ValidateGcpConnectionCredentialsSchema
+  [AppConnection.AzureKeyVault]: ValidateAzureKeyVaultConnectionCredentialsSchema,
+  [AppConnection.AzureAppConfiguration]: ValidateAzureKeyVaultConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
@@ -350,27 +350,7 @@ export const appConnectionServiceFactory = ({
       )
     );
 
-    const { decryptor } = await kmsService.createCipherPairWithDataKey({
+    return availableConnections as Omit<TAppConnection, "credentials">[];
-      type: KmsDataKey.Organization,
-      orgId: actor.orgId
-    });
-
-    const decryptedConnections = availableConnections.map((connection) => {
-      const decryptedPlainTextBlob = decryptor({
-        cipherTextBlob: connection.encryptedCredentials
-      });
-
-      const credentials = JSON.parse(decryptedPlainTextBlob.toString()) as TAppConnection["credentials"];
-
-      return {
-        ...connection,
-        ...(app === AppConnection.Azure && {
-          azureResource: (credentials as { resource: AzureResources }).resource
-        })
-      };
-    });
-
-    return decryptedConnections as Omit<TAppConnection, "credentials">[];
   };
 
   return {

backend/src/services/app-connection/app-connection-types.ts

@@ -12,20 +12,33 @@ import {
 } from "@app/services/app-connection/github";
 
 import {
-  TAzureConnection,
+  TAzureAppConfigurationConnection,
-  TAzureConnectionConfig,
+  TAzureAppConfigurationConnectionConfig,
-  TAzureConnectionInput,
+  TAzureAppConfigurationConnectionInput,
-  TValidateAzureConnectionCredentials
+  TValidateAzureAppConfigurationConnectionCredentials
-} from "./azure";
+} from "./azure-app-configuration";
+import {
+  TAzureKeyVaultConnection,
+  TAzureKeyVaultConnectionConfig,
+  TAzureKeyVaultConnectionInput,
+  TValidateAzureKeyVaultConnectionCredentials
+} from "./azure-key-vault";
 import { TGcpConnection, TGcpConnectionConfig, TGcpConnectionInput, TValidateGcpConnectionCredentials } from "./gcp";
 
-export type TAppConnection = { id: string } & (TAwsConnection | TGitHubConnection | TGcpConnection | TAzureConnection);
+export type TAppConnection = { id: string } & (
+  | TAwsConnection
+  | TGitHubConnection
+  | TGcpConnection
+  | TAzureKeyVaultConnection
+  | TAzureAppConfigurationConnection
+);
 
 export type TAppConnectionInput = { id: string } & (
   | TAwsConnectionInput
   | TGitHubConnectionInput
   | TGcpConnectionInput
-  | TAzureConnectionInput
+  | TAzureKeyVaultConnectionInput
+  | TAzureAppConfigurationConnectionInput
 );
 
 export type TCreateAppConnectionDTO = Pick<
@@ -41,10 +54,12 @@ export type TAppConnectionConfig =
   | TAwsConnectionConfig
   | TGitHubConnectionConfig
   | TGcpConnectionConfig
-  | TAzureConnectionConfig;
+  | TAzureKeyVaultConnectionConfig
+  | TAzureAppConfigurationConnectionConfig;
 
 export type TValidateAppConnectionCredentials =
   | TValidateAwsConnectionCredentials
   | TValidateGitHubConnectionCredentials
   | TValidateGcpConnectionCredentials
-  | TValidateAzureConnectionCredentials;
+  | TValidateAzureKeyVaultConnectionCredentials
+  | TValidateAzureAppConfigurationConnectionCredentials;

backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum AzureAppConfigurationConnectionMethod {
+  OAuth = "oauth"
+}

backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-fns.ts

@@ -0,0 +1,98 @@
+import { AxiosError, AxiosResponse } from "axios";
+
+import { getConfig } from "@app/lib/config/env";
+import { request } from "@app/lib/config/request";
+import { BadRequestError, InternalServerError } from "@app/lib/errors";
+import { getAppConnectionMethodName } from "@app/services/app-connection/app-connection-fns";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+import { AppConnection } from "../app-connection-enums";
+import { AzureAppConfigurationConnectionMethod } from "./azure-app-configuration-connection-enums";
+import {
+  ExchangeCodeAzureResponse,
+  TAzureAppConfigurationConnectionConfig
+} from "./azure-app-configuration-connection-types";
+
+export const getAzureAppConfigurationConnectionListItem = () => {
+  const { INF_APP_CONNECTION_AZURE_CLIENT_ID } = getConfig();
+
+  return {
+    name: "Azure App Configuration" as const,
+    app: AppConnection.AzureAppConfiguration as const,
+    methods: Object.values(AzureAppConfigurationConnectionMethod) as [AzureAppConfigurationConnectionMethod.OAuth],
+    oauthClientId: INF_APP_CONNECTION_AZURE_CLIENT_ID
+  };
+};
+
+export const validateAzureAppConfigurationConnectionCredentials = async (
+  config: TAzureAppConfigurationConnectionConfig
+) => {
+  const { credentials: inputCredentials, method } = config;
+
+  const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig();
+
+  if (!INF_APP_CONNECTION_AZURE_CLIENT_ID || !INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
+    throw new InternalServerError({
+      message: `Azure ${getAppConnectionMethodName(method)} environment variables have not been configured`
+    });
+  }
+
+  let tokenResp: AxiosResponse<ExchangeCodeAzureResponse> | null = null;
+  let tokenError: AxiosError | null = null;
+
+  try {
+    tokenResp = await request.post<ExchangeCodeAzureResponse>(
+      IntegrationUrls.AZURE_TOKEN_URL.replace("common", inputCredentials.tenantId || "common"),
+      new URLSearchParams({
+        grant_type: "authorization_code",
+        code: inputCredentials.code,
+        scope: `openid offline_access https://azconfig.io/.default`,
+        client_id: INF_APP_CONNECTION_AZURE_CLIENT_ID,
+        client_secret: INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
+        redirect_uri: `${SITE_URL}/organization/app-connections/azure/oauth/callback`
+      })
+    );
+  } catch (e: unknown) {
+    if (e instanceof AxiosError) {
+      tokenError = e;
+    } else {
+      throw new BadRequestError({
+        message: `Unable to validate connection - verify credentials`
+      });
+    }
+  }
+
+  if (tokenError) {
+    if (tokenError instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to get access token: ${
+          (tokenError?.response?.data as { error_description?: string })?.error_description || "Unknown error"
+        }`
+      });
+    } else {
+      throw new InternalServerError({
+        message: "Failed to get access token"
+      });
+    }
+  }
+
+  if (!tokenResp) {
+    throw new InternalServerError({
+      message: `Failed to get access token: Token was empty with no error`
+    });
+  }
+
+  switch (method) {
+    case AzureAppConfigurationConnectionMethod.OAuth:
+      return {
+        tenantId: inputCredentials.tenantId,
+        accessToken: tokenResp.data.access_token,
+        refreshToken: tokenResp.data.refresh_token,
+        expiresAt: Date.now() + tokenResp.data.expires_in * 1000
+      };
+    default:
+      throw new InternalServerError({
+        message: `Unhandled Azure connection method: ${method as AzureAppConfigurationConnectionMethod}`
+      });
+  }
+};

backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-schemas.ts

@@ -0,0 +1,77 @@
+import { z } from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { AzureAppConfigurationConnectionMethod } from "./azure-app-configuration-connection-enums";
+
+export const AzureAppConfigurationConnectionOAuthInputCredentialsSchema = z.object({
+  code: z.string().trim().min(1, "OAuth code required"),
+  tenantId: z.string().trim().optional()
+});
+
+export const AzureAppConfigurationConnectionOAuthOutputCredentialsSchema = z.object({
+  tenantId: z.string().optional(),
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresAt: z.number()
+});
+
+export const ValidateAzureAppConfigurationConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(AzureAppConfigurationConnectionMethod.OAuth)
+      .describe(AppConnections.CREATE(AppConnection.AzureAppConfiguration).method),
+    credentials: AzureAppConfigurationConnectionOAuthInputCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.AzureAppConfiguration).credentials
+    )
+  })
+]);
+
+export const CreateAzureAppConfigurationConnectionSchema = ValidateAzureAppConfigurationConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.AzureAppConfiguration)
+);
+
+export const UpdateAzureAppConfigurationConnectionSchema = z
+  .object({
+    credentials: AzureAppConfigurationConnectionOAuthInputCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.AzureAppConfiguration).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.AzureAppConfiguration));
+
+const BaseAzureAppConfigurationConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.AzureAppConfiguration)
+});
+
+export const AzureAppConfigurationConnectionSchema = z.intersection(
+  BaseAzureAppConfigurationConnectionSchema,
+  z.discriminatedUnion("method", [
+    z.object({
+      method: z.literal(AzureAppConfigurationConnectionMethod.OAuth),
+      credentials: AzureAppConfigurationConnectionOAuthOutputCredentialsSchema
+    })
+  ])
+);
+
+export const SanitizedAzureAppConfigurationConnectionSchema = z.discriminatedUnion("method", [
+  BaseAzureAppConfigurationConnectionSchema.extend({
+    method: z.literal(AzureAppConfigurationConnectionMethod.OAuth),
+    credentials: AzureAppConfigurationConnectionOAuthOutputCredentialsSchema.pick({
+      resource: true,
+      tenantId: true
+    })
+  })
+]);
+
+export const AzureAppConfigurationConnectionListItemSchema = z.object({
+  name: z.literal("Azure App Configuration"),
+  app: z.literal(AppConnection.AzureAppConfiguration),
+  methods: z.nativeEnum(AzureAppConfigurationConnectionMethod).array(),
+  oauthClientId: z.string().optional()
+});

backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-types.ts

@@ -0,0 +1,41 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  AzureAppConfigurationConnectionOAuthOutputCredentialsSchema,
+  AzureAppConfigurationConnectionSchema,
+  CreateAzureAppConfigurationConnectionSchema,
+  ValidateAzureAppConfigurationConnectionCredentialsSchema
+} from "./azure-app-configuration-connection-schemas";
+
+export type TAzureAppConfigurationConnection = z.infer<typeof AzureAppConfigurationConnectionSchema>;
+
+export type TAzureAppConfigurationConnectionInput = z.infer<typeof CreateAzureAppConfigurationConnectionSchema> & {
+  app: AppConnection.AzureAppConfiguration;
+};
+
+export type TValidateAzureAppConfigurationConnectionCredentials =
+  typeof ValidateAzureAppConfigurationConnectionCredentialsSchema;
+
+export type TAzureAppConfigurationConnectionConfig = DiscriminativePick<
+  TAzureAppConfigurationConnectionInput,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type ExchangeCodeAzureResponse = {
+  token_type: string;
+  scope: string;
+  expires_in: number;
+  ext_expires_in: number;
+  access_token: string;
+  refresh_token: string;
+  id_token: string;
+};
+
+export type TAzureAppConfigurationConnectionCredentials = z.infer<
+  typeof AzureAppConfigurationConnectionOAuthOutputCredentialsSchema
+>;

backend/src/services/app-connection/azure-app-configuration/index.ts

@@ -0,0 +1,4 @@
+export * from "./azure-app-configuration-connection-enums";
+export * from "./azure-app-configuration-connection-fns";
+export * from "./azure-app-configuration-connection-schemas";
+export * from "./azure-app-configuration-connection-types";

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum AzureKeyVaultConnectionMethod {
+  OAuth = "oauth"
+}

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-fns.ts

@@ -13,17 +13,12 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
 import { TAppConnectionDALFactory } from "../app-connection-dal";
 import { AppConnection } from "../app-connection-enums";
-import { AzureConnectionMethod, AzureResources } from "./azure-connection-enums";
+import { AzureKeyVaultConnectionMethod } from "./azure-key-vault-connection-enums";
 import {
   ExchangeCodeAzureResponse,
-  TAzureConnectionConfig,
+  TAzureKeyVaultConnectionConfig,
-  TAzureConnectionCredentials
+  TAzureKeyVaultConnectionCredentials
-} from "./azure-connection-types";
+} from "./azure-key-vault-connection-types";
-
-const resourceScopes: Record<AzureResources, string> = {
-  [AzureResources.AppConfiguration]: "https://azconfig.io/.default",
-  [AzureResources.KeyVault]: "https://vault.azure.net/.default"
-};
 
 export const getAzureConnectionAccessToken = async (
   connectionId: string,
@@ -31,6 +26,11 @@ export const getAzureConnectionAccessToken = async (
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
 ) => {
   const appCfg = getConfig();
+  if (!appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID || !appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
+    throw new BadRequestError({
+      message: `Azure environment variables have not been configured`
+    });
+  }
 
   const appConnection = await appConnectionDAL.findById(connectionId);
 
@@ -38,23 +38,23 @@ export const getAzureConnectionAccessToken = async (
     throw new NotFoundError({ message: `Connection with ID '${connectionId}' not found` });
   }
 
-  if (appConnection.app !== AppConnection.Azure) {
+  if (appConnection.app !== AppConnection.AzureKeyVault && appConnection.app !== AppConnection.AzureAppConfiguration) {
-    throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure connection` });
+    throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure Key Vault connection` });
   }
 
   const credentials = (await decryptAppConnectionCredentials({
     orgId: appConnection.orgId,
     kmsService,
     encryptedCredentials: appConnection.encryptedCredentials
-  })) as TAzureConnectionCredentials;
+  })) as TAzureKeyVaultConnectionCredentials;
 
   const { data } = await request.post<ExchangeCodeAzureResponse>(
     IntegrationUrls.AZURE_TOKEN_URL.replace("common", credentials.tenantId || "common"),
     new URLSearchParams({
       grant_type: "refresh_token",
       scope: `openid offline_access`,
-      client_id: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID!,
+      client_id: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID,
-      client_secret: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET!,
+      client_secret: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
       refresh_token: credentials.refreshToken
     })
   );
@@ -87,18 +87,18 @@ export const getAzureConnectionAccessToken = async (
   };
 };
 
-export const getAzureConnectionListItem = () => {
+export const getAzureKeyVaultConnectionListItem = () => {
   const { INF_APP_CONNECTION_AZURE_CLIENT_ID } = getConfig();
 
   return {
-    name: "Azure" as const,
+    name: "Azure Key Vault" as const,
-    app: AppConnection.Azure as const,
+    app: AppConnection.AzureKeyVault as const,
-    methods: Object.values(AzureConnectionMethod) as [AzureConnectionMethod.OAuth],
+    methods: Object.values(AzureKeyVaultConnectionMethod) as [AzureKeyVaultConnectionMethod.OAuth],
     oauthClientId: INF_APP_CONNECTION_AZURE_CLIENT_ID
   };
 };
 
-export const validateAzureConnectionCredentials = async (config: TAzureConnectionConfig) => {
+export const validateAzureKeyVaultConnectionCredentials = async (config: TAzureKeyVaultConnectionConfig) => {
   const { credentials: inputCredentials, method } = config;
 
   const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig();
@@ -118,7 +118,7 @@ export const validateAzureConnectionCredentials = async (config: TAzureConnectio
       new URLSearchParams({
         grant_type: "authorization_code",
         code: inputCredentials.code,
-        scope: `openid offline_access ${resourceScopes[inputCredentials.resource]}`,
+        scope: `openid offline_access https://vault.azure.net/.default`,
         client_id: INF_APP_CONNECTION_AZURE_CLIENT_ID,
         client_secret: INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
         redirect_uri: `${SITE_URL}/organization/app-connections/azure/oauth/callback`
@@ -155,16 +155,16 @@ export const validateAzureConnectionCredentials = async (config: TAzureConnectio
   }
 
   switch (method) {
-    case AzureConnectionMethod.OAuth:
+    case AzureKeyVaultConnectionMethod.OAuth:
       return {
+        tenantId: inputCredentials.tenantId,
         accessToken: tokenResp.data.access_token,
         refreshToken: tokenResp.data.refresh_token,
-        expiresAt: Date.now() + tokenResp.data.expires_in * 1000,
+        expiresAt: Date.now() + tokenResp.data.expires_in * 1000
-        resource: inputCredentials.resource
       };
     default:
       throw new InternalServerError({
-        message: `Unhandled Azure connection method: ${method as AzureConnectionMethod}`
+        message: `Unhandled Azure connection method: ${method as AzureKeyVaultConnectionMethod}`
       });
   }
 };

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-schemas.ts

@@ -0,0 +1,77 @@
+import { z } from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { AzureKeyVaultConnectionMethod } from "./azure-key-vault-connection-enums";
+
+export const AzureKeyVaultConnectionOAuthInputCredentialsSchema = z.object({
+  code: z.string().trim().min(1, "OAuth code required"),
+  tenantId: z.string().trim().optional()
+});
+
+export const AzureKeyVaultConnectionOAuthOutputCredentialsSchema = z.object({
+  tenantId: z.string().optional(),
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresAt: z.number()
+});
+
+export const ValidateAzureKeyVaultConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(AzureKeyVaultConnectionMethod.OAuth)
+      .describe(AppConnections.CREATE(AppConnection.AzureKeyVault).method),
+    credentials: AzureKeyVaultConnectionOAuthInputCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.AzureKeyVault).credentials
+    )
+  })
+]);
+
+export const CreateAzureKeyVaultConnectionSchema = ValidateAzureKeyVaultConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.AzureKeyVault)
+);
+
+export const UpdateAzureKeyVaultConnectionSchema = z
+  .object({
+    credentials: AzureKeyVaultConnectionOAuthInputCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.AzureKeyVault).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.AzureKeyVault));
+
+const BaseAzureKeyVaultConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.AzureKeyVault)
+});
+
+export const AzureKeyVaultConnectionSchema = z.intersection(
+  BaseAzureKeyVaultConnectionSchema,
+  z.discriminatedUnion("method", [
+    z.object({
+      method: z.literal(AzureKeyVaultConnectionMethod.OAuth),
+      credentials: AzureKeyVaultConnectionOAuthOutputCredentialsSchema
+    })
+  ])
+);
+
+export const SanitizedAzureKeyVaultConnectionSchema = z.discriminatedUnion("method", [
+  BaseAzureKeyVaultConnectionSchema.extend({
+    method: z.literal(AzureKeyVaultConnectionMethod.OAuth),
+    credentials: AzureKeyVaultConnectionOAuthOutputCredentialsSchema.pick({
+      resource: true,
+      tenantId: true
+    })
+  })
+]);
+
+export const AzureKeyVaultConnectionListItemSchema = z.object({
+  name: z.literal("Azure Key Vault"),
+  app: z.literal(AppConnection.AzureKeyVault),
+  methods: z.nativeEnum(AzureKeyVaultConnectionMethod).array(),
+  oauthClientId: z.string().optional()
+});

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-types.ts

@@ -0,0 +1,38 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  AzureKeyVaultConnectionOAuthOutputCredentialsSchema,
+  AzureKeyVaultConnectionSchema,
+  CreateAzureKeyVaultConnectionSchema,
+  ValidateAzureKeyVaultConnectionCredentialsSchema
+} from "./azure-key-vault-connection-schemas";
+
+export type TAzureKeyVaultConnection = z.infer<typeof AzureKeyVaultConnectionSchema>;
+
+export type TAzureKeyVaultConnectionInput = z.infer<typeof CreateAzureKeyVaultConnectionSchema> & {
+  app: AppConnection.AzureKeyVault;
+};
+
+export type TValidateAzureKeyVaultConnectionCredentials = typeof ValidateAzureKeyVaultConnectionCredentialsSchema;
+
+export type TAzureKeyVaultConnectionConfig = DiscriminativePick<
+  TAzureKeyVaultConnectionInput,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type ExchangeCodeAzureResponse = {
+  token_type: string;
+  scope: string;
+  expires_in: number;
+  ext_expires_in: number;
+  access_token: string;
+  refresh_token: string;
+  id_token: string;
+};
+
+export type TAzureKeyVaultConnectionCredentials = z.infer<typeof AzureKeyVaultConnectionOAuthOutputCredentialsSchema>;

backend/src/services/app-connection/azure-key-vault/index.ts

@@ -0,0 +1,4 @@
+export * from "./azure-key-vault-connection-enums";
+export * from "./azure-key-vault-connection-fns";
+export * from "./azure-key-vault-connection-schemas";
+export * from "./azure-key-vault-connection-types";

backend/src/services/app-connection/azure/azure-connection-enums.ts

@@ -1,8 +0,0 @@
-export enum AzureConnectionMethod {
-  OAuth = "oauth"
-}
-
-export enum AzureResources {
-  KeyVault = "key-vault",
-  AppConfiguration = "app-configuration"
-}

backend/src/services/app-connection/azure/azure-connection-schemas.ts

@@ -1,74 +0,0 @@
-import { z } from "zod";
-
-import { AppConnections } from "@app/lib/api-docs";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  BaseAppConnectionSchema,
-  GenericCreateAppConnectionFieldsSchema,
-  GenericUpdateAppConnectionFieldsSchema
-} from "@app/services/app-connection/app-connection-schemas";
-
-import { AzureConnectionMethod, AzureResources } from "./azure-connection-enums";
-
-export const AzureConnectionOAuthInputCredentialsSchema = z.object({
-  code: z.string().trim().min(1, "OAuth code required"),
-  tenantId: z.string().trim().optional(),
-  resource: z.nativeEnum(AzureResources)
-});
-
-export const AzureConnectionOAuthOutputCredentialsSchema = z.object({
-  tenantId: z.string().optional(),
-  accessToken: z.string(),
-  refreshToken: z.string(),
-  expiresAt: z.number(), // unix timestamp,
-  resource: z.nativeEnum(AzureResources)
-});
-
-export const ValidateAzureConnectionCredentialsSchema = z.discriminatedUnion("method", [
-  z.object({
-    method: z.literal(AzureConnectionMethod.OAuth).describe(AppConnections.CREATE(AppConnection.Azure).method),
-    credentials: AzureConnectionOAuthInputCredentialsSchema.describe(
-      AppConnections.CREATE(AppConnection.Azure).credentials
-    )
-  })
-]);
-
-export const CreateAzureConnectionSchema = ValidateAzureConnectionCredentialsSchema.and(
-  GenericCreateAppConnectionFieldsSchema(AppConnection.Azure)
-);
-
-export const UpdateAzureConnectionSchema = z
-  .object({
-    credentials: AzureConnectionOAuthInputCredentialsSchema.optional().describe(
-      AppConnections.UPDATE(AppConnection.Azure).credentials
-    )
-  })
-  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Azure));
-
-const BaseAzureConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Azure) });
-
-export const AzureConnectionSchema = z.intersection(
-  BaseAzureConnectionSchema,
-  z.discriminatedUnion("method", [
-    z.object({
-      method: z.literal(AzureConnectionMethod.OAuth),
-      credentials: AzureConnectionOAuthOutputCredentialsSchema
-    })
-  ])
-);
-
-export const SanitizedAzureConnectionSchema = z.discriminatedUnion("method", [
-  BaseAzureConnectionSchema.extend({
-    method: z.literal(AzureConnectionMethod.OAuth),
-    credentials: AzureConnectionOAuthOutputCredentialsSchema.pick({
-      resource: true
-    })
-  })
-]);
-
-export const AzureConnectionListItemSchema = z.object({
-  name: z.literal("Azure"),
-  app: z.literal(AppConnection.Azure),
-  methods: z.nativeEnum(AzureConnectionMethod).array(),
-  oauthClientId: z.string().optional()
-});

backend/src/services/app-connection/azure/azure-connection-types.ts

@@ -1,35 +0,0 @@
-import z from "zod";
-
-import { DiscriminativePick } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import {
-  AzureConnectionOAuthOutputCredentialsSchema,
-  AzureConnectionSchema,
-  CreateAzureConnectionSchema,
-  ValidateAzureConnectionCredentialsSchema
-} from "./azure-connection-schemas";
-
-export type TAzureConnection = z.infer<typeof AzureConnectionSchema>;
-
-export type TAzureConnectionInput = z.infer<typeof CreateAzureConnectionSchema> & {
-  app: AppConnection.Azure;
-};
-
-export type TValidateAzureConnectionCredentials = typeof ValidateAzureConnectionCredentialsSchema;
-
-export type TAzureConnectionConfig = DiscriminativePick<TAzureConnectionInput, "method" | "app" | "credentials"> & {
-  orgId: string;
-};
-
-export type ExchangeCodeAzureResponse = {
-  token_type: string;
-  scope: string;
-  expires_in: number;
-  ext_expires_in: number;
-  access_token: string;
-  refresh_token: string;
-  id_token: string;
-};
-
-export type TAzureConnectionCredentials = z.infer<typeof AzureConnectionOAuthOutputCredentialsSchema>;

backend/src/services/app-connection/azure/index.ts

@@ -1,4 +0,0 @@
-export * from "./azure-connection-enums";
-export * from "./azure-connection-fns";
-export * from "./azure-connection-schemas";
-export * from "./azure-connection-types";

backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-constants.ts

@@ -5,6 +5,6 @@ import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types
 export const AZURE_APP_CONFIGURATION_SYNC_LIST_OPTION: TSecretSyncListItem = {
   name: "Azure App Configuration",
   destination: SecretSync.AzureAppConfiguration,
-  connection: AppConnection.Azure,
+  connection: AppConnection.AzureAppConfiguration,
-  canImportSecrets: false
+  canImportSecrets: true
 };

backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-fns.ts

@@ -4,7 +4,7 @@ import https from "https";
 import { request } from "@app/lib/config/request";
 import { BadRequestError } from "@app/lib/errors";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
-import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure";
+import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-key-vault";
 import { isAzureKeyVaultReference } from "@app/services/integration-auth/integration-sync-secret-fns";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";

backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-schemas.ts

@@ -40,7 +40,7 @@ export const UpdateAzureAppConfigurationSyncSchema = GenericUpdateSecretSyncFiel
 
 export const AzureAppConfigurationSyncListItemSchema = z.object({
   name: z.literal("Azure App Configuration"),
-  connection: z.literal(AppConnection.Azure),
+  connection: z.literal(AppConnection.AzureAppConfiguration),
   destination: z.literal(SecretSync.AzureAppConfiguration),
-  canImportSecrets: z.literal(false)
+  canImportSecrets: z.literal(true)
 });

backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-types.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { TAzureConnection } from "@app/services/app-connection/azure";
+import { TAzureAppConfigurationConnection } from "@app/services/app-connection/azure-app-configuration";
 
 import {
   AzureAppConfigurationSyncListItemSchema,
@@ -15,5 +15,5 @@ export type TAzureAppConfigurationSyncInput = z.infer<typeof CreateAzureAppConfi
 export type TAzureAppConfigurationSyncListItem = z.infer<typeof AzureAppConfigurationSyncListItemSchema>;
 
 export type TAzureAppConfigurationSyncWithCredentials = TAzureAppConfigurationSync & {
-  connection: TAzureConnection;
+  connection: TAzureAppConfigurationConnection;
 };

backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-constants.ts

@@ -5,6 +5,6 @@ import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types
 export const AZURE_KEY_VAULT_SYNC_LIST_OPTION: TSecretSyncListItem = {
   name: "Azure Key Vault",
   destination: SecretSync.AzureKeyVault,
-  connection: AppConnection.Azure,
+  connection: AppConnection.AzureKeyVault,
-  canImportSecrets: false
+  canImportSecrets: true
 };

backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-fns.ts

@@ -3,7 +3,7 @@ import { AxiosError } from "axios";
 
 import { request } from "@app/lib/config/request";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
-import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure";
+import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-key-vault";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
 
@@ -172,6 +172,10 @@ export const azureKeyVaultSecretSyncFactory = ({
           }
         }
       }
+
+      if (!isSecretSet) {
+        throw new Error(`Failed to set secret ${key}`);
+      }
     };
 
     for await (const setSecret of setSecrets) {

backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-schemas.ts

@@ -10,7 +10,7 @@ import {
 import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
 
 const AzureKeyVaultSyncDestinationConfigSchema = z.object({
-  vaultBaseUrl: z.string().min(1, "Vault base URL required")
+  vaultBaseUrl: z.string().url("Invalid vault base URL format").min(1, "Vault base URL required")
 });
 
 const AzureKeyVaultSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
@@ -39,7 +39,7 @@ export const UpdateAzureKeyVaultSyncSchema = GenericUpdateSecretSyncFieldsSchema
 
 export const AzureKeyVaultSyncListItemSchema = z.object({
   name: z.literal("Azure Key Vault"),
-  connection: z.literal(AppConnection.Azure),
+  connection: z.literal(AppConnection.AzureKeyVault),
   destination: z.literal(SecretSync.AzureKeyVault),
-  canImportSecrets: z.literal(false)
+  canImportSecrets: z.literal(true)
 });

backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-types.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { TAzureConnection } from "@app/services/app-connection/azure";
+import { TAzureKeyVaultConnection } from "@app/services/app-connection/azure-key-vault";
 
 import {
   AzureKeyVaultSyncListItemSchema,
@@ -15,7 +15,7 @@ export type TAzureKeyVaultSyncInput = z.infer<typeof CreateAzureKeyVaultSyncSche
 export type TAzureKeyVaultSyncListItem = z.infer<typeof AzureKeyVaultSyncListItemSchema>;
 
 export type TAzureKeyVaultSyncWithCredentials = TAzureKeyVaultSync & {
-  connection: TAzureConnection;
+  connection: TAzureKeyVaultConnection;
 };
 
 export interface GetAzureKeyVaultSecret {

backend/src/services/secret-sync/secret-sync-fns.ts

@@ -93,16 +93,6 @@ export const SecretSyncFns = {
   ): Promise<void> => {
     // const affixedSecretMap = addAffixes(secretSync, secretMap);
 
-    const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
-      appConnectionDAL,
-      kmsService
-    });
-
-    const azureAppConfigurationSecretSync = azureAppConfigurationSecretSyncFactory({
-      appConnectionDAL,
-      kmsService
-    });
-
     switch (secretSync.destination) {
       case SecretSync.AWSParameterStore:
         return AwsParameterStoreSyncFns.syncSecrets(secretSync, secretMap);
@@ -113,9 +103,15 @@ export const SecretSyncFns = {
       case SecretSync.GCPSecretManager:
         return GcpSyncFns.syncSecrets(secretSync, secretMap);
       case SecretSync.AzureKeyVault:
-        return azureKeyVaultSecretSync.syncSecrets(secretSync, secretMap);
+        return azureKeyVaultSecretSyncFactory({
+          appConnectionDAL,
+          kmsService
+        }).syncSecrets(secretSync, secretMap);
       case SecretSync.AzureAppConfiguration:
-        return azureAppConfigurationSecretSync.syncSecrets(secretSync, secretMap);
+        return azureAppConfigurationSecretSyncFactory({
+          appConnectionDAL,
+          kmsService
+        }).syncSecrets(secretSync, secretMap);
       default:
         throw new Error(
           `Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -126,16 +122,6 @@ export const SecretSyncFns = {
     secretSync: TSecretSyncWithCredentials,
     { kmsService, appConnectionDAL }: TSyncSecretDeps
   ): Promise<TSecretMap> => {
-    const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
-      appConnectionDAL,
-      kmsService
-    });
-
-    const azureAppConfigurationSecretSync = azureAppConfigurationSecretSyncFactory({
-      appConnectionDAL,
-      kmsService
-    });
-
     let secretMap: TSecretMap;
     switch (secretSync.destination) {
       case SecretSync.AWSParameterStore:
@@ -151,10 +137,16 @@ export const SecretSyncFns = {
         secretMap = await GcpSyncFns.getSecrets(secretSync);
         break;
       case SecretSync.AzureKeyVault:
-        secretMap = await azureKeyVaultSecretSync.getSecrets(secretSync);
+        secretMap = await azureKeyVaultSecretSyncFactory({
+          appConnectionDAL,
+          kmsService
+        }).getSecrets(secretSync);
         break;
       case SecretSync.AzureAppConfiguration:
-        secretMap = await azureAppConfigurationSecretSync.getSecrets(secretSync);
+        secretMap = await azureAppConfigurationSecretSyncFactory({
+          appConnectionDAL,
+          kmsService
+        }).getSecrets(secretSync);
         break;
       default:
         throw new Error(
@@ -172,16 +164,6 @@ export const SecretSyncFns = {
   ): Promise<void> => {
     // const affixedSecretMap = addAffixes(secretSync, secretMap);
 
-    const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
-      appConnectionDAL,
-      kmsService
-    });
-
-    const azureAppConfigurationSecretSync = azureAppConfigurationSecretSyncFactory({
-      appConnectionDAL,
-      kmsService
-    });
-
     switch (secretSync.destination) {
       case SecretSync.AWSParameterStore:
         return AwsParameterStoreSyncFns.removeSecrets(secretSync, secretMap);
@@ -192,9 +174,15 @@ export const SecretSyncFns = {
       case SecretSync.GCPSecretManager:
         return GcpSyncFns.removeSecrets(secretSync, secretMap);
       case SecretSync.AzureKeyVault:
-        return azureKeyVaultSecretSync.removeSecrets(secretSync, secretMap);
+        return azureKeyVaultSecretSyncFactory({
+          appConnectionDAL,
+          kmsService
+        }).removeSecrets(secretSync, secretMap);
       case SecretSync.AzureAppConfiguration:
-        return azureAppConfigurationSecretSync.removeSecrets(secretSync, secretMap);
+        return azureAppConfigurationSecretSyncFactory({
+          appConnectionDAL,
+          kmsService
+        }).removeSecrets(secretSync, secretMap);
       default:
         throw new Error(
           `Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`

backend/src/services/secret-sync/secret-sync-maps.ts

@@ -15,6 +15,6 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.AWSSecretsManager]: AppConnection.AWS,
   [SecretSync.GitHub]: AppConnection.GitHub,
   [SecretSync.GCPSecretManager]: AppConnection.GCP,
-  [SecretSync.AzureKeyVault]: AppConnection.Azure,
+  [SecretSync.AzureKeyVault]: AppConnection.AzureKeyVault,
-  [SecretSync.AzureAppConfiguration]: AppConnection.Azure
+  [SecretSync.AzureAppConfiguration]: AppConnection.AzureAppConfiguration
 };

frontend/src/components/secret-syncs/forms/SecretSyncConnectionField.tsx

@@ -18,9 +18,6 @@ import { TSecretSyncForm } from "./schemas";
 
 type Props = {
   onChange?: VoidFunction;
-  filterConnections?: (
-    connections?: TAvailableAppConnection[]
-  ) => TAvailableAppConnection[] | undefined;
 };
 
 export const SecretSyncConnectionField = ({ onChange: callback, filterConnections }: Props) => {
@@ -30,7 +27,7 @@ export const SecretSyncConnectionField = ({ onChange: callback, filterConnection
   const destination = watch("destination");
   const app = SECRET_SYNC_CONNECTION_MAP[destination];
 
-  const { data: allConnections, isLoading } = useListAvailableAppConnections(app);
+  const { data: availableConnections, isLoading } = useListAvailableAppConnections(app);
 
   const connectionName = APP_CONNECTION_MAP[app].name;
 
@@ -39,10 +36,6 @@ export const SecretSyncConnectionField = ({ onChange: callback, filterConnection
     OrgPermissionSubjects.AppConnections
   );
 
-  const availableConnections = useMemo(() => {
-    return filterConnections ? filterConnections(allConnections) : allConnections;
-  }, [allConnections]);
-
   const appName = APP_CONNECTION_MAP[SECRET_SYNC_CONNECTION_MAP[destination]].name;
 
   return (

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/AzureAppConfigurationSyncFields.tsx

@@ -2,8 +2,6 @@ import { Controller, useFormContext } from "react-hook-form";
 
 import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
 import { FormControl, Input } from "@app/components/v2";
-import { AzureResources } from "@app/hooks/api/appConnections";
-import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import { SecretSync } from "@app/hooks/api/secretSyncs";
 
 import { TSecretSyncForm } from "../schemas";
@@ -19,15 +17,6 @@ export const AzureAppConfigurationSyncFields = () => {
         onChange={() => {
           setValue("destinationConfig.configurationUrl", "");
         }}
-        filterConnections={(connections) => {
-          if (!connections) return connections;
-
-          return connections.filter(
-            (connection) =>
-              connection.app === AppConnection.Azure &&
-              connection.azureResource === AzureResources.AppConfiguration
-          );
-        }}
       />
       <Controller
         name="destinationConfig.configurationUrl"

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/AzureKeyVaultSyncFields.tsx

@@ -2,8 +2,6 @@ import { Controller, useFormContext } from "react-hook-form";
 
 import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
 import { FormControl, Input } from "@app/components/v2";
-import { AzureResources } from "@app/hooks/api/appConnections";
-import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import { SecretSync } from "@app/hooks/api/secretSyncs";
 
 import { TSecretSyncForm } from "../schemas";
@@ -19,15 +17,6 @@ export const AzureKeyVaultSyncFields = () => {
         onChange={() => {
           setValue("destinationConfig.vaultBaseUrl", "");
         }}
-        filterConnections={(connections) => {
-          if (!connections) return connections;
-
-          return connections.filter(
-            (connection) =>
-              connection.app === AppConnection.Azure &&
-              connection.azureResource === AzureResources.KeyVault
-          );
-        }}
       />
       <Controller
         name="destinationConfig.vaultBaseUrl"

frontend/src/components/secret-syncs/forms/schemas/azure-key-vault-sync-destination-schema.ts

@@ -5,6 +5,6 @@ import { SecretSync } from "@app/hooks/api/secretSyncs";
 export const AzureKeyVaultSyncDestinationSchema = z.object({
   destination: z.literal(SecretSync.AzureKeyVault),
   destinationConfig: z.object({
-    vaultBaseUrl: z.string().min(1, "Vault Base URL required")
+    vaultBaseUrl: z.string().url("Invalid vault base URL format").min(1, "Vault base URL required")
   })
 });

frontend/src/helpers/appConnections.ts

@@ -4,6 +4,8 @@ import { faKey, faPassport, faUser } from "@fortawesome/free-solid-svg-icons";
 import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import {
   AwsConnectionMethod,
+  AzureAppConfigurationConnectionMethod,
+  AzureKeyVaultConnectionMethod,
   GcpConnectionMethod,
   GitHubConnectionMethod,
   TAppConnection
@@ -16,13 +18,19 @@ export const APP_CONNECTION_MAP: Record<AppConnection, { name: string; image: st
     name: "GCP",
     image: "Google Cloud Platform.png"
   },
-  [AppConnection.Azure]: { name: "Azure", image: "Microsoft Azure.png" }
+  [AppConnection.AzureKeyVault]: { name: "Azure Key Vault", image: "Microsoft Azure.png" },
+  [AppConnection.AzureAppConfiguration]: {
+    name: "Azure App Configuration",
+    image: "Microsoft Azure.png"
+  }
 };
 
 export const getAppConnectionMethodDetails = (method: TAppConnection["method"]) => {
   switch (method) {
     case GitHubConnectionMethod.App:
       return { name: "GitHub App", icon: faGithub };
+    case AzureKeyVaultConnectionMethod.OAuth:
+    case AzureAppConfigurationConnectionMethod.OAuth:
     case GitHubConnectionMethod.OAuth:
       return { name: "OAuth", icon: faPassport };
     case AwsConnectionMethod.AccessKey:

frontend/src/helpers/secretSyncs.ts

@@ -22,8 +22,8 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.AWSSecretsManager]: AppConnection.AWS,
   [SecretSync.GitHub]: AppConnection.GitHub,
   [SecretSync.GCPSecretManager]: AppConnection.GCP,
-  [SecretSync.AzureKeyVault]: AppConnection.Azure,
+  [SecretSync.AzureKeyVault]: AppConnection.AzureKeyVault,
-  [SecretSync.AzureAppConfiguration]: AppConnection.Azure
+  [SecretSync.AzureAppConfiguration]: AppConnection.AzureAppConfiguration
 };
 
 export const SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP: Record<

frontend/src/hooks/api/appConnections/enums.ts

@@ -2,5 +2,6 @@ export enum AppConnection {
   AWS = "aws",
   GitHub = "github",
   GCP = "gcp",
-  Azure = "azure"
+  AzureKeyVault = "azure-key-vault",
+  AzureAppConfiguration = "azure-app-configuration"
 }

frontend/src/hooks/api/appConnections/types/app-options.ts

@@ -20,8 +20,13 @@ export type TGcpConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.GCP;
 };
 
-export type TAzureConnectionOption = TAppConnectionOptionBase & {
+export type TAzureKeyVaultConnectionOption = TAppConnectionOptionBase & {
-  app: AppConnection.Azure;
+  app: AppConnection.AzureKeyVault;
+  oauthClientId?: string;
+};
+
+export type TAzureAppConfigurationConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.AzureKeyVault;
   oauthClientId?: string;
 };
 
@@ -31,5 +36,6 @@ export type TAppConnectionOptionMap = {
   [AppConnection.AWS]: TAwsConnectionOption;
   [AppConnection.GitHub]: TGitHubConnectionOption;
   [AppConnection.GCP]: TGcpConnectionOption;
-  [AppConnection.Azure]: TAzureConnectionOption;
+  [AppConnection.AzureKeyVault]: TAzureKeyVaultConnectionOption;
+  [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnectionOption;
 };

frontend/src/hooks/api/appConnections/types/azure-app-configuration-connection.ts

@@ -0,0 +1,16 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum AzureAppConfigurationConnectionMethod {
+  OAuth = "oauth"
+}
+
+export type TAzureAppConfigurationConnection = TRootAppConnection & {
+  app: AppConnection.AzureAppConfiguration;
+} & {
+  method: AzureAppConfigurationConnectionMethod.OAuth;
+  credentials: {
+    code: string;
+    tenantId?: string;
+  };
+};

frontend/src/hooks/api/appConnections/types/azure-connection.ts

@@ -1,26 +0,0 @@
-import { AppConnection } from "@app/hooks/api/appConnections/enums";
-import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
-
-export enum AzureConnectionMethod {
-  OAuth = "oauth"
-}
-
-export enum AzureResources {
-  KeyVault = "key-vault",
-  AppConfiguration = "app-configuration"
-}
-
-export const azureResourcesMap: Record<AzureResources, string> = {
-  [AzureResources.AppConfiguration]: "App Configuration",
-  [AzureResources.KeyVault]: "Key Vault"
-};
-
-export type TAzureConnection = TRootAppConnection & { app: AppConnection.Azure } & {
-  method: AzureConnectionMethod.OAuth;
-  resource: AzureResources;
-  credentials: {
-    code: string;
-    tenantId?: string;
-    resource: AzureResources;
-  };
-};

frontend/src/hooks/api/appConnections/types/azure-key-vault-connection.ts

@@ -0,0 +1,14 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum AzureKeyVaultConnectionMethod {
+  OAuth = "oauth"
+}
+
+export type TAzureKeyVaultConnection = TRootAppConnection & { app: AppConnection.AzureKeyVault } & {
+  method: AzureKeyVaultConnectionMethod.OAuth;
+  credentials: {
+    code: string;
+    tenantId?: string;
+  };
+};

frontend/src/hooks/api/appConnections/types/index.ts

@@ -3,22 +3,24 @@ import { TAppConnectionOption } from "@app/hooks/api/appConnections/types/app-op
 import { TAwsConnection } from "@app/hooks/api/appConnections/types/aws-connection";
 import { TGitHubConnection } from "@app/hooks/api/appConnections/types/github-connection";
 
-import { AzureResources, TAzureConnection } from "./azure-connection";
+import { TAzureAppConfigurationConnection } from "./azure-app-configuration-connection";
+import { TAzureKeyVaultConnection } from "./azure-key-vault-connection";
 import { TGcpConnection } from "./gcp-connection";
 
 export * from "./aws-connection";
-export * from "./azure-connection";
+export * from "./azure-app-configuration-connection";
+export * from "./azure-key-vault-connection";
 export * from "./gcp-connection";
 export * from "./github-connection";
 
-export type TAppConnection = TAwsConnection | TGitHubConnection | TGcpConnection | TAzureConnection;
+export type TAppConnection =
+  | TAwsConnection
+  | TGitHubConnection
+  | TGcpConnection
+  | TAzureKeyVaultConnection
+  | TAzureAppConfigurationConnection;
 
-export type TAvailableAppConnection =
+export type TAvailableAppConnection = Pick<TAppConnection, "name" | "id">;
-  | (Pick<TAppConnection, "name" | "id"> & { app: Exclude<AppConnection, AppConnection.Azure> })
-  | (Pick<TAppConnection, "name" | "id"> & {
-      app: AppConnection.Azure;
-      azureResource?: AzureResources;
-    });
 
 export type TListAppConnections<T extends TAppConnection> = { appConnections: T[] };
 export type TGetAppConnection<T extends TAppConnection> = { appConnection: T };
@@ -47,5 +49,6 @@ export type TAppConnectionMap = {
   [AppConnection.AWS]: TAwsConnection;
   [AppConnection.GitHub]: TGitHubConnection;
   [AppConnection.GCP]: TGcpConnection;
-  [AppConnection.Azure]: TAzureConnection;
+  [AppConnection.AzureKeyVault]: TAzureKeyVaultConnection;
+  [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection;
 };

frontend/src/hooks/api/secretSyncs/types/azure-app-configuration-sync.ts

@@ -9,7 +9,7 @@ export type TAzureAppConfigurationSync = TRootSecretSync & {
     label?: string;
   };
   connection: {
-    app: AppConnection.Azure;
+    app: AppConnection.AzureAppConfiguration;
     name: string;
     id: string;
   };

frontend/src/hooks/api/secretSyncs/types/azure-key-vault-sync.ts

@@ -8,7 +8,7 @@ export type TAzureKeyVaultSync = TRootSecretSync & {
     vaultBaseUrl: string;
   };
   connection: {
-    app: AppConnection.Azure;
+    app: AppConnection.AzureKeyVault;
     name: string;
     id: string;
   };

frontend/src/pages/organization/AppConnections/OauthCallbackPage/OauthCallbackPage.tsx

@@ -5,9 +5,10 @@ import { createNotification } from "@app/components/notifications";
 import { ContentLoader } from "@app/components/v2";
 import { ROUTE_PATHS } from "@app/const/routes";
 import {
-  AzureConnectionMethod,
+  AzureAppConfigurationConnectionMethod,
-  AzureResources,
+  AzureKeyVaultConnectionMethod,
   GitHubConnectionMethod,
+  TAzureKeyVaultConnection,
   TGitHubConnection,
   useCreateAppConnection,
   useUpdateAppConnection
@@ -22,18 +23,20 @@ type GithubFormData = Pick<TGitHubConnection, "name" | "method" | "description">
 type AzureFormData = Pick<TGitHubConnection, "name" | "method" | "description"> & {
   returnUrl?: string;
   connectionId?: string;
-  tenantId?: string;
+} & Pick<TAzureKeyVaultConnection["credentials"], "tenantId">;
-  resource: AzureResources;
-};
 
 type FormDataMap = {
   [AppConnection.GitHub]: GithubFormData & { app: AppConnection.GitHub };
-  [AppConnection.Azure]: AzureFormData & { app: AppConnection.Azure };
+  [AppConnection.AzureKeyVault]: AzureFormData & { app: AppConnection.AzureKeyVault };
+  [AppConnection.AzureAppConfiguration]: AzureFormData & {
+    app: AppConnection.AzureAppConfiguration;
+  };
 };
 
 const formDataStorageFieldMap: Partial<Record<AppConnection, string>> = {
   [AppConnection.GitHub]: "githubConnectionFormData",
-  [AppConnection.Azure]: "azureConnectionFormData"
+  [AppConnection.AzureKeyVault]: "azureKeyVaultConnectionFormData",
+  [AppConnection.AzureAppConfiguration]: "azureAppConfigurationConnectionFormData"
 };
 
 export const OAuthCallbackPage = () => {
@@ -44,7 +47,7 @@ export const OAuthCallbackPage = () => {
     from: ROUTE_PATHS.Organization.AppConnections.OauthCallbackPage.id
   });
 
-  const appConnection = useParams({
+  const rawAppConnection = useParams({
     strict: false,
     select: (el) => el?.appConnection as AppConnection
   });
@@ -52,7 +55,10 @@ export const OAuthCallbackPage = () => {
   const updateAppConnection = useUpdateAppConnection();
   const createAppConnection = useCreateAppConnection();
 
-  const { code, state, installation_id: installationId } = search;
+  const { code, state: rawState, installation_id: installationId } = search;
+
+  const state = rawState.includes("<:>") ? rawState.split("<:>")[0] : rawState;
+  const appConnection = rawState.includes("<:>") ? rawState.split("<:>")[1] : rawAppConnection;
 
   const clearState = (app: AppConnection) => {
     if (state !== localStorage.getItem("latestCSRFToken")) {
@@ -85,18 +91,18 @@ export const OAuthCallbackPage = () => {
     }
   };
 
-  const handleAzure = useCallback(async () => {
+  const handleAzureKeyVault = useCallback(async () => {
-    const formData = getFormData(AppConnection.Azure);
+    const formData = getFormData(AppConnection.AzureKeyVault);
     if (formData === null) return null;
 
-    clearState(AppConnection.Azure);
+    clearState(AppConnection.AzureKeyVault);
 
     const { connectionId, name, description, returnUrl } = formData;
 
     try {
       if (connectionId) {
         await updateAppConnection.mutateAsync({
-          app: AppConnection.Azure,
+          app: AppConnection.AzureKeyVault,
           connectionId,
           credentials: {
             code: code as string
@@ -104,12 +110,11 @@ export const OAuthCallbackPage = () => {
         });
       } else {
         await createAppConnection.mutateAsync({
-          app: AppConnection.Azure,
+          app: AppConnection.AzureKeyVault,
           name,
           description,
-          method: AzureConnectionMethod.OAuth,
+          method: AzureKeyVaultConnectionMethod.OAuth,
           credentials: {
-            resource: formData.resource,
             tenantId: formData.tenantId,
             code: code as string
           }
@@ -133,6 +138,52 @@ export const OAuthCallbackPage = () => {
     };
   }, []);
 
+  const handleAzureAppConfiguration = useCallback(async () => {
+    const formData = getFormData(AppConnection.AzureAppConfiguration);
+    if (formData === null) return null;
+
+    clearState(AppConnection.AzureAppConfiguration);
+
+    const { connectionId, name, description, returnUrl } = formData;
+
+    try {
+      if (connectionId) {
+        await updateAppConnection.mutateAsync({
+          app: AppConnection.AzureAppConfiguration,
+          connectionId,
+          credentials: {
+            code: code as string
+          }
+        });
+      } else {
+        await createAppConnection.mutateAsync({
+          app: AppConnection.AzureAppConfiguration,
+          name,
+          description,
+          method: AzureAppConfigurationConnectionMethod.OAuth,
+          credentials: {
+            code: code as string
+          }
+        });
+      }
+    } catch (err: any) {
+      createNotification({
+        title: `Failed to ${connectionId ? "update" : "add"} Azure Connection`,
+        text: err?.message,
+        type: "error"
+      });
+      navigate({
+        to: returnUrl ?? "/organization/settings?selectedTab=app-connections"
+      });
+    }
+
+    return {
+      connectionId,
+      returnUrl,
+      appConnectionName: formData.app
+    };
+  }, []);
+
   const handleGithub = useCallback(async () => {
     const formData = getFormData(AppConnection.GitHub);
     if (formData === null) return null;
@@ -215,8 +266,10 @@ export const OAuthCallbackPage = () => {
 
       if (appConnection === AppConnection.GitHub) {
         data = await handleGithub();
-      } else if (appConnection === AppConnection.Azure) {
+      } else if (appConnection === AppConnection.AzureKeyVault) {
-        data = await handleAzure();
+        data = await handleAzureKeyVault();
+      } else if (appConnection === AppConnection.AzureAppConfiguration) {
+        data = await handleAzureAppConfiguration();
       }
 
       if (data) {
@@ -224,6 +277,11 @@ export const OAuthCallbackPage = () => {
           text: `Successfully ${data.connectionId ? "updated" : "added"} ${data.appConnectionName || ""} Connection`,
           type: "success"
         });
+      } else {
+        createNotification({
+          text: "Failed to add connection",
+          type: "error"
+        });
       }
 
       await navigate({

frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/AppConnectionForm/AppConnectionForm.tsx

@@ -10,7 +10,8 @@ import { DiscriminativePick } from "@app/types";
 
 import { AppConnectionHeader } from "../AppConnectionHeader";
 import { AwsConnectionForm } from "./AwsConnectionForm";
-import { AzureConnectionForm } from "./AzureConnectionForm";
+import { AzureAppConfigurationConnectionForm } from "./AzureAppConfigurationConnectionForm";
+import { AzureKeyVaultConnectionForm } from "./AzureKeyVaultConnectionForm";
 import { GcpConnectionForm } from "./GcpConnectionForm";
 import { GitHubConnectionForm } from "./GitHubConnectionForm";
 
@@ -54,8 +55,10 @@ const CreateForm = ({ app, onComplete }: CreateFormProps) => {
       return <GitHubConnectionForm />;
     case AppConnection.GCP:
       return <GcpConnectionForm onSubmit={onSubmit} />;
-    case AppConnection.Azure:
+    case AppConnection.AzureKeyVault:
-      return <AzureConnectionForm />;
+      return <AzureKeyVaultConnectionForm />;
+    case AppConnection.AzureAppConfiguration:
+      return <AzureAppConfigurationConnectionForm />;
     default:
       throw new Error(`Unhandled App ${app}`);
   }
@@ -95,8 +98,10 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
       return <GitHubConnectionForm appConnection={appConnection} />;
     case AppConnection.GCP:
       return <GcpConnectionForm appConnection={appConnection} onSubmit={onSubmit} />;
-    case AppConnection.Azure:
+    case AppConnection.AzureKeyVault:
-      return <AzureConnectionForm appConnection={appConnection} />;
+      return <AzureKeyVaultConnectionForm appConnection={appConnection} />;
+    case AppConnection.AzureAppConfiguration:
+      return <AzureAppConfigurationConnectionForm appConnection={appConnection} />;
     default:
       throw new Error(`Unhandled App ${(appConnection as TAppConnection).app}`);
   }

frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/AppConnectionForm/AzureAppConfigurationConnectionForm.tsx

@@ -0,0 +1,177 @@
+import crypto from "crypto";
+
+import { useState } from "react";
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import { Button, FormControl, Input, ModalClose, Select, SelectItem } from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { isInfisicalCloud } from "@app/helpers/platform";
+import {
+  AzureAppConfigurationConnectionMethod,
+  TAzureAppConfigurationConnection,
+  useGetAppConnectionOption
+} from "@app/hooks/api/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TAzureAppConfigurationConnection;
+};
+
+const formSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.AzureAppConfiguration),
+  method: z.nativeEnum(AzureAppConfigurationConnectionMethod),
+  tenantId: z.string().trim().optional()
+});
+
+type FormData = z.infer<typeof formSchema>;
+
+export const AzureAppConfigurationConnectionForm = ({ appConnection }: Props) => {
+  const isUpdate = Boolean(appConnection);
+  const [isRedirecting, setIsRedirecting] = useState(false);
+
+  const {
+    option: { oauthClientId },
+    isLoading
+  } = useGetAppConnectionOption(AppConnection.AzureAppConfiguration);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection
+      ? {
+          ...appConnection
+        }
+      : {
+          app: AppConnection.AzureAppConfiguration,
+          method: AzureAppConfigurationConnectionMethod.OAuth
+        }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    watch,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  const selectedMethod = watch("method");
+
+  const onSubmit = (formData: FormData) => {
+    setIsRedirecting(true);
+    const state = crypto.randomBytes(16).toString("hex");
+    localStorage.setItem("latestCSRFToken", state);
+    localStorage.setItem(
+      "azureAppConfigurationConnectionFormData",
+      JSON.stringify({ ...formData, connectionId: appConnection?.id })
+    );
+
+    switch (formData.method) {
+      case AzureAppConfigurationConnectionMethod.OAuth:
+        window.location.assign(
+          `https://login.microsoftonline.com/${formData.tenantId || "common"}/oauth2/v2.0/authorize?client_id=${oauthClientId}&response_type=code&redirect_uri=${window.location.origin}/organization/app-connections/azure/oauth/callback&response_mode=query&scope=https://azconfig.io/.default%20openid%20offline_access&state=${state}<:>azure-app-configuration`
+        );
+        break;
+      default:
+        throw new Error(`Unhandled Azure Connection method: ${(formData as FormData).method}`);
+    }
+  };
+
+  let isMissingConfig: boolean;
+
+  switch (selectedMethod) {
+    case AzureAppConfigurationConnectionMethod.OAuth:
+      isMissingConfig = !oauthClientId;
+      break;
+    default:
+      throw new Error(`Unhandled Azure Connection method: ${selectedMethod}`);
+  }
+
+  const methodDetails = getAppConnectionMethodDetails(selectedMethod);
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+
+        <Controller
+          name="tenantId"
+          control={control}
+          render={({ field, fieldState: { error } }) => (
+            <FormControl
+              tooltipText="The Azure Active Directory (Entra ID) Tenant ID."
+              isError={Boolean(error?.message)}
+              label="Tenant ID"
+              isOptional
+              errorText={error?.message}
+            >
+              <Input {...field} placeholder="e4f34ea5-ad23-4291-8585-66d20d603cc8" />
+            </FormControl>
+          )}
+        />
+
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.AzureAppConfiguration].name
+              }. This field cannot be changed after creation.`}
+              errorText={
+                !isLoading && isMissingConfig
+                  ? `Environment variables have not been configured. ${
+                      isInfisicalCloud()
+                        ? "Please contact Infisical."
+                        : `See documentation to configure Azure ${methodDetails.name} Connections.`
+                    }`
+                  : error?.message
+              }
+              isError={Boolean(error?.message) || isMissingConfig}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(AzureAppConfigurationConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting || isRedirecting}
+            isDisabled={isSubmitting || (!isUpdate && !isDirty) || isMissingConfig || isRedirecting}
+          >
+            {isUpdate ? "Reconnect to Azure" : "Connect to Azure"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};

frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/AppConnectionForm/AzureKeyVaultConnectionForm.tsx

@@ -11,10 +11,9 @@ import { isInfisicalCloud } from "@app/helpers/platform";
 import { useGetAppConnectionOption } from "@app/hooks/api/appConnections";
 import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import {
-  AzureConnectionMethod,
+  AzureKeyVaultConnectionMethod,
-  AzureResources,
+  TAzureKeyVaultConnection
-  TAzureConnection
+} from "@app/hooks/api/appConnections/types/azure-key-vault-connection";
-} from "@app/hooks/api/appConnections/types/azure-connection";
 
 import {
   genericAppConnectionFieldsSchema,
@@ -22,43 +21,35 @@ import {
 } from "./GenericAppConnectionFields";
 
 type Props = {
-  appConnection?: TAzureConnection;
+  appConnection?: TAzureKeyVaultConnection;
-};
-
-const resourceScopes: Record<AzureResources, string> = {
-  [AzureResources.AppConfiguration]: "https://azconfig.io/.default",
-  [AzureResources.KeyVault]: "https://vault.azure.net/.default"
 };
 
 const formSchema = genericAppConnectionFieldsSchema.extend({
-  app: z.literal(AppConnection.Azure),
+  app: z.literal(AppConnection.AzureKeyVault),
-  method: z.nativeEnum(AzureConnectionMethod),
+  method: z.nativeEnum(AzureKeyVaultConnectionMethod),
-  tenantId: z.string().trim().optional(),
+  tenantId: z.string().trim().optional()
-  resource: z.nativeEnum(AzureResources)
 });
 
 type FormData = z.infer<typeof formSchema>;
 
-export const AzureConnectionForm = ({ appConnection }: Props) => {
+export const AzureKeyVaultConnectionForm = ({ appConnection }: Props) => {
   const isUpdate = Boolean(appConnection);
   const [isRedirecting, setIsRedirecting] = useState(false);
 
   const {
     option: { oauthClientId },
     isLoading
-  } = useGetAppConnectionOption(AppConnection.Azure);
+  } = useGetAppConnectionOption(AppConnection.AzureKeyVault);
 
   const form = useForm<FormData>({
     resolver: zodResolver(formSchema),
     defaultValues: appConnection
       ? {
-          ...appConnection,
+          ...appConnection
-          resource: appConnection?.credentials.resource
         }
       : {
-          app: AppConnection.Azure,
+          app: AppConnection.AzureKeyVault,
-          method: AzureConnectionMethod.OAuth,
+          method: AzureKeyVaultConnectionMethod.OAuth
-          resource: AzureResources.KeyVault
         }
   });
 
@@ -76,14 +67,14 @@ export const AzureConnectionForm = ({ appConnection }: Props) => {
     const state = crypto.randomBytes(16).toString("hex");
     localStorage.setItem("latestCSRFToken", state);
     localStorage.setItem(
-      "azureConnectionFormData",
+      "azureKeyVaultConnectionFormData",
       JSON.stringify({ ...formData, connectionId: appConnection?.id })
     );
 
     switch (formData.method) {
-      case AzureConnectionMethod.OAuth:
+      case AzureKeyVaultConnectionMethod.OAuth:
         window.location.assign(
-          `https://login.microsoftonline.com/${formData.tenantId || "common"}/oauth2/v2.0/authorize?client_id=${oauthClientId}&response_type=code&redirect_uri=${window.location.origin}/organization/app-connections/azure/oauth/callback&response_mode=query&scope=${resourceScopes[formData.resource]}%20openid%20offline_access&state=${state}`
+          `https://login.microsoftonline.com/${formData.tenantId || "common"}/oauth2/v2.0/authorize?client_id=${oauthClientId}&response_type=code&redirect_uri=${window.location.origin}/organization/app-connections/azure/oauth/callback&response_mode=query&scope=https://vault.azure.net/.default%20openid%20offline_access&state=${state}<:>azure-key-vault`
         );
         break;
       default:
@@ -94,7 +85,7 @@ export const AzureConnectionForm = ({ appConnection }: Props) => {
   let isMissingConfig: boolean;
 
   switch (selectedMethod) {
-    case AzureConnectionMethod.OAuth:
+    case AzureKeyVaultConnectionMethod.OAuth:
       isMissingConfig = !oauthClientId;
       break;
     default:
@@ -113,7 +104,7 @@ export const AzureConnectionForm = ({ appConnection }: Props) => {
           control={control}
           render={({ field, fieldState: { error } }) => (
             <FormControl
-              tooltipText="The Azure Active Directory (Entra ID) Tenant ID. This field cannot be changed after creation."
+              tooltipText="The Azure Active Directory (Entra ID) Tenant ID."
               isError={Boolean(error?.message)}
               label="Tenant ID"
               isOptional
@@ -124,40 +115,13 @@ export const AzureConnectionForm = ({ appConnection }: Props) => {
           )}
         />
 
-        <Controller
-          name="resource"
-          control={control}
-          render={({ field: { value, onChange }, fieldState: { error } }) => (
-            <FormControl
-              tooltipText="Select the Azure resource you would like the app connection to access."
-              errorText={error?.message}
-              isError={Boolean(error?.message)}
-              label="Resource"
-            >
-              <Select
-                isDisabled={isUpdate}
-                value={value}
-                onValueChange={(val) => onChange(val)}
-                className="w-full border border-mineshaft-500"
-                position="popper"
-                dropdownContainerClassName="max-w-none"
-              >
-                <SelectItem value={AzureResources.KeyVault}>Azure Key Vault</SelectItem>
-                <SelectItem value={AzureResources.AppConfiguration}>
-                  Azure App Configuration
-                </SelectItem>
-              </Select>
-            </FormControl>
-          )}
-        />
-
         <Controller
           name="method"
           control={control}
           render={({ field: { value, onChange }, fieldState: { error } }) => (
             <FormControl
               tooltipText={`The method you would like to use to connect with ${
-                APP_CONNECTION_MAP[AppConnection.Azure].name
+                APP_CONNECTION_MAP[AppConnection.AzureKeyVault].name
               }. This field cannot be changed after creation.`}
               errorText={
                 !isLoading && isMissingConfig
@@ -179,7 +143,7 @@ export const AzureConnectionForm = ({ appConnection }: Props) => {
                 position="popper"
                 dropdownContainerClassName="max-w-none"
               >
-                {Object.values(AzureConnectionMethod).map((method) => {
+                {Object.values(AzureKeyVaultConnectionMethod).map((method) => {
                   return (
                     <SelectItem value={method} key={method}>
                       {getAppConnectionMethodDetails(method).name}

frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/AppConnectionRow.tsx

@@ -27,8 +27,7 @@ import { OrgPermissionSubjects } from "@app/context";
 import { OrgPermissionAppConnectionActions } from "@app/context/OrgPermissionContext/types";
 import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
 import { useToggle } from "@app/hooks";
-import { azureResourcesMap, TAppConnection } from "@app/hooks/api/appConnections";
+import { TAppConnection } from "@app/hooks/api/appConnections";
-import { AppConnection } from "@app/hooks/api/appConnections/enums";
 
 type Props = {
   appConnection: TAppConnection;
@@ -43,7 +42,7 @@ export const AppConnectionRow = ({
   onEditCredentials,
   onEditDetails
 }: Props) => {
-  const { id, name, method, app, description, credentials } = appConnection;
+  const { id, name, method, app, description } = appConnection;
 
   const [isIdCopied, setIsIdCopied] = useToggle(false);
 
@@ -76,10 +75,7 @@ export const AppConnectionRow = ({
             src={`/images/integrations/${APP_CONNECTION_MAP[app].image}`}
             className="mr-0.5 h-5 w-5"
           />
-          <span className="hidden lg:inline">
+          <span className="hidden lg:inline">{APP_CONNECTION_MAP[app].name}</span>
-            {APP_CONNECTION_MAP[app].name}
-            {app === AppConnection.Azure && ` ${azureResourcesMap[credentials.resource]}`}
-          </span>
         </div>
       </Td>
       <Td className="!min-w-[8rem] max-w-0">

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/AzureAppConfigurationSyncDestinationSection.tsx

@@ -13,9 +13,7 @@ export const AzureAppConfigurationSyncDestinationSection = ({ secretSync }: Prop
   return (
     <>
       <SecretSyncLabel label="Configuration URL">{configurationUrl}</SecretSyncLabel>
-      <SecretSyncLabel label="Label">
+      <SecretSyncLabel label="Label">{label}</SecretSyncLabel>
-        {label && label.length > 0 ? label : <span className="opacity-40">Not set</span>}
-      </SecretSyncLabel>
     </>
   );
 };