Key Vault references in App Service in Azure - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a Key Vault reference in Azure App Service?

A Key Vault reference in Azure App Service is a way to securely access secrets, keys, or certificates stored in Azure Key Vault directly from your app's configuration without exposing them in your code.

intermediate

How do you enable a Key Vault reference in an Azure App Service application setting?

You set the application setting value to a special syntax: @Microsoft.KeyVault(SecretUri=https://{vault-name}.vault.azure.net/secrets/{secret-name}/{secret-version}), which tells App Service to fetch the secret from Key Vault at runtime.

intermediate

What permission must the App Service have to access secrets in Key Vault?

The App Service's managed identity must have 'Get' permission on secrets in the Key Vault's access policies or via Azure RBAC to retrieve secrets securely.

beginner

Why use Key Vault references instead of storing secrets directly in App Service settings?

Using Key Vault references keeps secrets out of app settings, reducing risk of exposure. It centralizes secret management, supports automatic secret rotation, and improves security compliance.

intermediate

Can Key Vault references in App Service automatically update when the secret changes?

Yes, App Service periodically refreshes Key Vault references, so when a secret is updated in Key Vault, the app can get the new value without redeployment.

What syntax is used to reference a Key Vault secret in an App Service application setting?

A @Microsoft.KeyVault(SecretUri=https://{vault-name}.vault.azure.net/secrets/{secret-name}/{secret-version})

B https://{vault-name}.vault.azure.net/secrets/{secret-name}

C KeyVaultSecret:{secret-name}

D vault://{vault-name}/secret/{secret-name}

The correct syntax uses @Microsoft.KeyVault with the full SecretUri to tell App Service to fetch the secret at runtime.

Which identity must have permission to access Key Vault secrets for App Service Key Vault references to work?

A App Service's managed identity

B User's personal Azure account

C Azure subscription owner

D Any Azure AD user

The App Service's managed identity needs 'Get' permission on Key Vault secrets to access them securely.

What is a key benefit of using Key Vault references in App Service?

A Secrets are hardcoded in application code

B Secrets are securely fetched at runtime without exposing them

C Secrets are stored in plain text in app settings

D Secrets are emailed to developers automatically

Key Vault references allow secure runtime fetching of secrets without exposing them in app settings or code.

How does App Service handle secret updates in Key Vault when using Key Vault references?

A App Service requires manual redeployment to update secrets

B Secrets never update once app is running

C App Service automatically refreshes secrets periodically

D Secrets are updated only when app restarts

App Service periodically refreshes Key Vault references to get updated secret values automatically.

What permission is specifically required on Key Vault for App Service to read secrets?

A List

B Set

C Delete

D Get

The 'Get' permission allows reading secrets from Key Vault, which is necessary for App Service to access them.

Explain how Key Vault references improve security in Azure App Service.

Think about how secrets are handled and accessed without exposing them.

Describe the steps to configure an Azure App Service to use a Key Vault reference for a secret.

Consider identity, permissions, and app settings.