| `AZURE_OIDC_AUD` | The `aud` claim for the JWT | `api://AzureADTokenExchange` ([recommended default value](https://learn.microsoft.com/en-us/azure/active-directory/workload-identities/workload-identity-federation-create-trust?pivots=identity-wif-apps-methods-azp#important-considerations-and-restrictions)) |
| `AZURE_OIDC_CLIENT_ID` | Default Service Principal client ID associated with GitLab to [authenticate using OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/azure/) | _none_ (disabled) |
@@ -350,7 +350,7 @@ This variant allows delegating your secrets management to a [Vault](https://www.
In order to be able to communicate with the Vault server, the variant requires the additional configuration parameters:
| `TBC_VAULT_IMAGE` | The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use (can be overridden) | `$CI_REGISTRY/to-be-continuous/tools/vault-secrets-provider:master` |
| `VAULT_BASE_URL` | The Vault server base API url | _none_ |
@@ -368,7 +368,7 @@ Then you may retrieve any of your secret(s) from Vault using the following synta