# Managing Credential Stores > 1. Click **Add** on the **Credential Stores** page. The **Add New Credential Store** dialog appears. 2. From the **Type** drop-down, select which secure store is used. 3. The next steps will vary if you are creating an Orchestrator Database, CyberArk, or Azure Key Vault credential store. 4. Create a store using one of the platforms below. ## Creating a Credential Store 1. Click **Add** on the **Credential Stores** page. The **Add New Credential Store** dialog appears. 2. From the **Type** drop-down, select which secure store is used. 3. The next steps will vary if you are creating an Orchestrator Database, CyberArk, or Azure Key Vault credential store. 4. Create a store using one of the platforms below. **Orchestrator Database** 1. Click **Create**, Orchestrator database stores do not have any configurable properties. :::note You can only have one Orchestrator Database store. ::: **CyberArk** :::note CyberArk was rebranded to Idira following its acquisition by Palo Alto Networks. Orchestrator's UI, configuration keys, and credential store type names continue to reference CyberArk. ::: :::note A CyberArk store configured in multiple tenants using the same App ID, Safe, and Folder Name, will permit access to stored credentials across tenants. To maintain tenant-level security and isolation, ensure different configurations are used for each tenant's CyberArk store. ::: 1. In the **Name** field, type a name for the new credential store. 2. In the **App ID** field, enter the application ID for your Orchestrator instance from the CyberArk® PVWA (Password Vault Web Access) interface. See [here](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/Common/Adding-Applications.htm?tocpath=Administration%7CApplication%20management%7C_____1) for details. 3. In the **CyberArk Safe** field, enter the safe name as defined in the CyberArk® PVWA. See [here](storing-credentials-in-cyberark.md) for details. 4. In the **CyberArk Folder** field, enter the location in which CyberArk® stores your credentials. 5. Click **Create**. Your new credential store is ready for use. ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-227471-cf4d5e7c.webp) **CyberArk CCP** :::note A CyberArk store configured in multiple tenants using the same App ID, Safe, and Folder Name, will permit access to stored credentials across tenants. To maintain tenant-level security and isolation, ensure different configurations are used for each tenant's CyberArk store. ::: 1. In the **Name** field, type a name for the new credential store. 2. In the **App ID** field, enter the application ID for your Orchestrator instance from the CyberArk® PVWA (Password Vault Web Access) interface. See [here](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/Common/Adding-Applications.htm?tocpath=Administration%7CApplication%20management%7C_____1) for details. 3. In the **CyberArk Safe** field, enter the safe name defined in the CyberArk® PVWA. See [here](cyberark-ccp-integration.md) for details. 4. In the **CyberArk Folder** field, enter the location in which CyberArk® stores your credentials. 5. In the **Central Credential Provider URL** field, enter the Central Credential Provider's address. 6. In the **Web Service Name** field, enter the name of the Central Credential Provider web service. If you leave this field empty, the default name is used: **AIMWebService**. 7. The **Client Certificate** needs to be configured when the the CyberArk Application uses the [client certificate authentication method](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CP%20and%20ASCP/Application-Authentication-Methods-general.htm#ClientCert). The expected input is a `.pfx` file which stores the private and the public key of the certificate. The client certificate needs to be installed on the machine where CyberArk CCP AIMWebservice is deployed. :::note The client certificate is used by CyberArk credential provided to authenticate the application defined in Orchestrator credential store. See the official CyberArk documentation for details on [application authentication methods](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CP%20and%20ASCP/Application-Authentication-Methods-general.htm#ClientCert). The client certificate is a PKCS12 binary format file that stores the certificate chain public key(s) and the private key. If the client certificate is encoded in base 64 then run the following `certutil` command to decode it in binary format: `certutil -decode client_certificate_encoded.pfx client_certificate.pfx` ::: * In the **Client Certificate Password** field, enter the password of the client certificate. * The **Server Root Certificate** needs to be configured when a self signed Root CA certificate is used by the CyberArk CCP AIMWebService for incoming HTTP requests. It is used in HTTPS TLS handshake certificate chain validation. The expected input is a `.crt` file which stores the root CA certificate public key. * Click **Create**. Your new credential store is ready for use. ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-225706-4cb26326.webp) **Azure Key Vault** Key Vault credential stores use [RBAC](https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault#resources) type authentication. After you've created a service principal, perform these steps: 1. In the **Name** field, type a name for the new credential store. 2. In the **Key Vault Uri** field, enter the address of your Azure Key Vault. This is `https://.vault.azure.net/`. 3. In the **Directory ID** field, enter the directory ID found in the Azure portal. ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-226775-c42a4162.webp) 4. In the **Client Id** field, enter the Application ID from your Azure AD App Registrations section where the Orchestrator app was registered. 5. In the **Client Secret** field, enter the secret needed to authenticate the client account entered in the previous step. 6. Click **Create**. Your new credential store is ready for use. ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-226174-793a1e97.webp) ## Editing a credential store Navigate to **Stores** (Tenant > **Credentials** > **Stores**) and from the **More Actions** menu of the desired store, select **Edit**. The **Edit Credential Store** dialog appears is displayed. :::note The **Orchestrator Database** store does not have any editable properties. ::: ## Setting a Default Credential Store When using 2 or more credential stores, you have the ability to select which is the default store used for Robots and Assets. The same store may be used as the default for both, or you can select a different default store for each. To select a default store, from the **More Actions** menu, select **Set as robots default store** and/or **Set as assets default store**. :::note Changing the default store does not change an existing robot or asset configuration, it only controls what appears pre-selected in the **Credential Stores** drop-down when creating new robots or assets. Robots and assets always get their passwords from the store that was used when creating them. To change the credential store for a certain robot or asset, you must change it at the robot or asset level. ::: ## Deleting a credential store To delete a credential store, select **Remove** from the **More Actions** menu of the desired store. If the selected store is in use, a warning dialog will appear listing the number of robots and assets that will be affected. Click **Delete** to confirm the removal or **Cancel** to abort. Note that you must have at least one credential store active at all times. If only one is present, then the option to delete it does not appear. :::note A credential store designated as default cannot be deleted. You must first select a different default store for the credential type. :::