Court e-filing integration keys in Key Vault are approaching expiration. What operational practice should the clerk AI team follow?

Court e-filing integration keys stored in Key Vault will eventually expire; the clerk AI team should use Key Vault expiration reminders (and related alerting) and rotate secrets before the e-filing keys lapse. Proactive rotation keeps the clerk AI integrations authenticating to court systems without an outage cliff, preserves audit history of versions, and aligns with municipal change windows rather than emergency break-glass during filing deadlines.

Waiting until calls fail in production before rotating anything turns a predictable calendar event into an avoidable outage for clerks and filers. Disabling expiration tracking so ops never sees upcoming dates removes the early-warning system Key Vault provides. Committing replacement keys into public ACR image layers for convenience leaks credentials into image history and bypasses Key Vault controls entirely.

Exam caveat: Expiration reminders notify; they do not rotate by themselves. Applications should prefer the latest enabled secret version (or a controlled rotation pattern) rather than hard-pinning a version GUID forever. Coordinate dual-running old/new keys with the court e-filing provider when both must be valid during cutover, and ensure managed identities retain get permissions on the new version.

Operational check: Enable Key Vault event alerts or Logic App/automation on near-expiry secrets for e-filing keys, schedule rotation before the expiry date, update any dependent App Configuration references if used, restart or refresh clerk AI workloads that cache secrets, and verify a successful authenticated e-filing test call. Confirm the previous version is disabled only after cutover success and that diagnostics show gets against the new version.