Secure, Monitor, and Troubleshoot Azure Solutions · Topic 1 of 2
Azure Key Vault and Azure App Configuration
AI-200 secure configuration: reading and rotating secrets in Key Vault with managed identities, and storing settings and feature flags in App Configuration.
- 4 min
- Key Vault holds secrets, keys and certificates; access with a managed identity and RBAC.
- Key Vault Secrets User reads secrets; Key Vault references let platforms fetch them.
- Rotation: new versions, near-expiry events through Event Grid, key rotation policies.
What it is
Azure Key Vault stores secrets, keys and certificates securely. Azure App Configuration stores application settings and feature flags in one place. Together they keep sensitive values and configuration out of code, and let you change them without redeploying.
How it works
Reading secrets from Key Vault
- Give the app a managed identity and grant it a data role on the vault, such as Key Vault Secrets User to read secrets (with Azure RBAC permission model).
- In code, create a SecretClient with the vault URL and
DefaultAzureCredential, then callget_secret. - App Service and Functions can use Key Vault references in app settings, so the platform fetches the value for the app.
- Each secret has versions. Referencing a secret without a version returns the latest one.
Rotation
| Approach | How it works |
|---|---|
| Versioned secrets | Add a new version; apps that read the latest version pick it up |
| Near-expiry events | Key Vault publishes events through Event Grid, such as a secret nearing expiry (30 days before it expires), that can trigger a function to rotate it |
| Key rotation policy | Keys (not secrets) can be rotated automatically on a schedule |
Apps should not cache a secret forever; refresh it periodically or on failure so a rotated value is picked up.
Protection settings
- Soft delete is on by default and can't be turned off; deleted vaults and objects stay recoverable for 7 to 90 days (90 by default).
- Purge protection (off by default) prevents permanent deletion during that period.
- Network rules and private endpoints limit who can reach the vault.
Azure App Configuration
| Feature | Use |
|---|---|
| Key-values | Central settings, such as model deployment names or batch sizes |
| Labels | Different values for the same key per environment, such as dev and prod |
| Feature flags | Turn features on or off without redeploying |
| Key Vault references | Point a setting at a Key Vault secret; the app resolves it with its identity |
| Dynamic refresh | Apps reload settings when they change, often watching a sentinel key |
Apps connect with the App Configuration provider library using the store endpoint and DefaultAzureCredential, with a role such as App Configuration Data Reader. In Python, load() with refresh_on=[WatchKey("sentinel")] sets up the watch, and the app calls refresh(), which checks for changes once the refresh interval (30 seconds by default) has passed.
A worked example: an AI API reads its model deployment name and chunk size from App Configuration, labeled per environment. The database password is a Key Vault reference in App Configuration. The API's managed identity has App Configuration Data Reader and Key Vault Secrets User, so no credential appears in code.
App Configuration is for settings; Key Vault is for secrets. Store a secret in Key Vault and reference it from App Configuration, not the other way round.
How the exam asks about this
- "Read a secret in code without storing any credential." Managed identity, SecretClient and DefaultAzureCredential.
- "Use different values for the same setting in dev and prod." App Configuration labels.
- "Rotate a secret automatically before it expires." Handle Key Vault near-expiry events with a function, or use a rotation policy for keys.
What to remember for the exam
- Key Vault holds secrets, keys and certificates; access with a managed identity and RBAC.
- Key Vault Secrets User reads secrets; Key Vault references let platforms fetch them.
- Rotation: new versions, near-expiry events through Event Grid, key rotation policies.
- App Configuration: key-values, labels, feature flags, Key Vault references, dynamic refresh.
- Soft delete and purge protection guard against accidental deletion.
Putting a secret value directly into App Configuration exposes it to anyone who can read settings. Use a Key Vault reference.
Common mistakes
Using access keys in code. Use managed identities.
Caching secrets forever. Refresh so rotations take effect.
Storing secrets as plain App Configuration values. Reference Key Vault instead.
Check yourself
Which role lets an app read secret values from Key Vault using Azure RBAC?
Key Vault Secrets User.
What are App Configuration labels used for?
Storing different values for the same key, for example per environment.
How can an app be told to reload all settings when they change?
Use dynamic refresh, typically watching a sentinel key.
Topic 1 of 2 in Secure, Monitor, and Troubleshoot Azure Solutions
Test yourself on Secure, Monitor, and Troubleshoot Azure Solutions
The full Microsoft AI-200 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.