TopolearnSecrets that can't be eliminated belong in Key Vault, not in code, pipelines or app settings.
Azure Key Vault stores three kinds of objects:
- Secrets: arbitrary strings such as API keys and third-party passwords.
- Keys: RSA/EC keys for encryption and signing; operations happen inside the vault (HSM-backed in Premium or Managed HSM), so the private key never leaves.
- Certificates: X.509 certificates with lifecycle management and auto-renewal from supported issuers.
Every object is versioned. A URI without a version (https://kv-orders.vault.azure.net/secrets/db-password) returns the latest.
Authorization: use the Azure RBAC permission model (the default for new vaults) rather than legacy access policies. Typical roles: Key Vault Secrets User (read secret values), Key Vault Secrets Officer (manage secrets), Key Vault Crypto User, Key Vault Administrator. Grant the app's managed identity Secrets User on just that vault.
Soft delete is always on (7 to 90 days retention), so a deleted vault or secret can be recovered, and its name stays reserved until purged. Enable purge protection for production so nobody can permanently destroy keys during the retention period.
App Service, Functions and Container Apps can reference secrets without code: an app setting value of @Microsoft.KeyVault(SecretUri=...) is resolved by the platform using the app's identity. Lock the vault down with a private endpoint and disabled public access.
Example
az keyvault create -g rg-sec -n kv-orders-prod --enable-purge-protection true
az keyvault secret set --vault-name kv-orders-prod -n db-password --value 'S3cr3t!'
# Let the web app's identity read secrets in this vault only
KV_ID=$(az keyvault show -n kv-orders-prod --query id -o tsv)
az role assignment create --assignee "$APP_PRINCIPAL_ID" \
--role "Key Vault Secrets User" --scope "$KV_ID"
# Platform-resolved reference: the app sees the secret as env var DB_PASSWORD
az webapp config appsettings set -g rg-web -n orders-web --settings \
"DB_PASSWORD=@Microsoft.KeyVault(SecretUri=https://kv-orders-prod.vault.azure.net/secrets/db-password/)"Remember
- Secrets, keys and certificates, all versioned
- Use the RBAC model; grant Secrets User to the app's identity
- Soft delete is mandatory; add purge protection in production
- Key Vault references inject secrets into app settings without code
Watch out for
- Recreating a deleted vault with the same name and getting a conflict: it is still soft-deleted until purged or recovered.