diff --git a/docs/src/main/asciidoc/authentication.adoc b/docs/src/main/asciidoc/authentication.adoc
index 540dd9b1..e33bd481 100644
--- a/docs/src/main/asciidoc/authentication.adoc
+++ b/docs/src/main/asciidoc/authentication.adoc
@@ -381,8 +381,8 @@ spring.cloud.vault:
     azure-msi:
         role: my-dev-role
         azure-path: azure
-        metadata-service: http://169.254.169.254/metadata/instance...
-        identity-token-service: http://169.254.169.254/metadata/identity...
+        metadata-service: http://169.254.169.254/metadata/instance…
+        identity-token-service: http://169.254.169.254/metadata/identity…
 ----
 ====
 
@@ -391,9 +391,12 @@ spring.cloud.vault:
 * `metadata-service` sets the URI at which to access the instance metadata service
 * `identity-token-service` sets the URI at which to access the identity token service
 
-Azure MSI authentication fetches environmental details about the virtual machine (subscription Id, resource group, VM name) from the instance metadata service. By default, Azure assumes your Vault server has Resource ID `https://vault.hashicorp.com`. To change this, set `spring.cloud.vault.azure-msi.identity-token-service`.
+Azure MSI authentication obtains environmental details about the virtual machine (subscription Id, resource group, VM name) from the instance metadata service.
+The Vault server has Resource Id defaults to `https://vault.hashicorp.com`.
+To change this, set `spring.cloud.vault.azure-msi.identity-token-service` accordingly.
+
+See also:
 
-See also: 
 * https://www.vaultproject.io/docs/auth/azure.html[Vault Documentation: Using the azure auth backend]
 * https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service[Azure Documentation: Azure Instance Metadata Service]
 
diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java
index a13782be..aa002eda 100644
--- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java
+++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java
@@ -18,7 +18,6 @@ package org.springframework.cloud.vault.config;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
-import java.net.URI;
 import java.util.Base64;
 import java.util.concurrent.atomic.AtomicReference;
 
@@ -263,7 +262,7 @@ class ClientAuthenticationFactory {
 		AwsEc2AuthenticationOptions authenticationOptions = AwsEc2AuthenticationOptions.builder().role(awsEc2.getRole()) //
 				.path(awsEc2.getAwsEc2Path()) //
 				.nonce(nonce) //
-				.identityDocumentUri(URI.create(awsEc2.getIdentityDocument())) //
+				.identityDocumentUri(awsEc2.getIdentityDocument()) //
 				.build();
 
 		return new AwsEc2Authentication(authenticationOptions, this.restOperations, this.externalRestOperations);
diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java
index 7bf6c309..f3a38f50 100644
--- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java
+++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java
@@ -532,7 +532,7 @@ public class VaultProperties implements EnvironmentAware {
 		/**
 		 * URL of the AWS-EC2 PKCS7 identity document.
 		 */
-		private String identityDocument = "http://169.254.169.254/latest/dynamic/instance-identity/pkcs7";
+		private URI identityDocument = URI.create("http://169.254.169.254/latest/dynamic/instance-identity/pkcs7");
 
 		/**
 		 * Mount path of the AWS-EC2 authentication backend.
@@ -551,11 +551,11 @@ public class VaultProperties implements EnvironmentAware {
 		@Nullable
 		private String nonce;
 
-		public String getIdentityDocument() {
+		public URI getIdentityDocument() {
 			return this.identityDocument;
 		}
 
-		public void setIdentityDocument(String identityDocument) {
+		public void setIdentityDocument(URI identityDocument) {
 			this.identityDocument = identityDocument;
 		}
 
@@ -668,12 +668,16 @@ public class VaultProperties implements EnvironmentAware {
 		private String role = "";
 
 		/**
-		 * Instance metadata service URI
+		 * Instance metadata service URI.
+		 *
+		 * @since 3.0
 		 */
 		private URI metadataService = AzureMsiAuthenticationOptions.DEFAULT_INSTANCE_METADATA_SERVICE_URI;
 
 		/**
-		 * Identity token service URI
+		 * Identity token service URI.
+		 *
+		 * @since 3.0
 		 */
 		private URI identityTokenService = AzureMsiAuthenticationOptions.DEFAULT_IDENTITY_TOKEN_SERVICE_URI;
 
@@ -681,30 +685,30 @@ public class VaultProperties implements EnvironmentAware {
 			return this.azurePath;
 		}
 
-		public String getRole() {
-			return this.role;
-		}
-
-		public URI getMetadataService() {
-			return metadataService;
-		}
-
-		public URI getIdentityTokenService() {
-			return identityTokenService;
-		}
-
 		public void setAzurePath(String azurePath) {
 			this.azurePath = azurePath;
 		}
 
+		public String getRole() {
+			return this.role;
+		}
+
 		public void setRole(String role) {
 			this.role = role;
 		}
 
+		public URI getMetadataService() {
+			return this.metadataService;
+		}
+
 		public void setMetadataService(URI metadataService) {
 			this.metadataService = metadataService;
 		}
 
+		public URI getIdentityTokenService() {
+			return this.identityTokenService;
+		}
+
 		public void setIdentityTokenService(URI identityTokenService) {
 			this.identityTokenService = identityTokenService;
 		}