> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://help.moveworks.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.moveworks.com/_mcp/server.

# On-Prem Agent Secrets Management

By default, the Moveworks On-Prem Agent stores service account credentials encrypted locally on the server (AES-256 encryption at rest).

The agent can also be configured to fetch credentials at runtime from an external secrets manager. This allows your organization to centralize credential management and rotate secrets without touching the agent config directly.

Supported platforms:

* [AWS Secrets Manager](/agent-studio/core-platform/moveworks-agent/moveworks-agent-configuration-guides/aws-secrets-manager) — configure IAM permissions and store secrets under the `moveworks_agent/*` path
* [Azure Key Vault](/agent-studio/core-platform/moveworks-agent/moveworks-agent-configuration-guides/azure-key-vault) — configure a managed identity on the agent VM and grant Key Vault Secrets User access