Secure Azure solutions
Where it sits in the route
This module follows identity and data access. It teaches the boundary between configuration and secrets, delegated storage access, and credentialless workload access before the application calls platform services.
Prerequisites and outcomes
Know principals, authentication versus authorization, TLS, tokens, app settings, and Azure RBAC. You should be able to select App Configuration, Key Vault, SAS, or managed identity for a requirement and diagnose whether a failure occurs while obtaining a token, authorizing access, or reading the secret/data.
Concept sequence and relationships
App Configuration centralizes application settings and feature values; Key Vault protects secrets, keys, and certificates. A workload authenticates as a managed identity, and a role or vault permission authorizes retrieval. A SAS delegates scoped, time-bounded storage access; a storage account key is broader and harder to rotate safely. TLS protects data in transit but does not grant data access.
Authentication establishes the principal; authorization grants that principal access. A valid managed-identity token with no Key Vault permission is still rejected. A valid SAS with the wrong resource, permission, or expiry is also rejected. Do not put a client secret in source control to solve a missing role assignment.
Worked scenario
An App Service reads a nonsecret feature flag from App Configuration and a database credential from Key Vault using its managed identity. A client receives a read-only, short-lived SAS for one uploaded blob. The app never stores a storage account key or forwards its own Key Vault secret to the client.
Conceptual checkpoint
For a failed secret read, classify the failure as missing identity, token audience, authorization, vault name, or secret version. For a file-download requirement, justify managed identity, Entra authorization, or SAS and state the scope and expiry boundary.
Hands-on / what to try
Review a configuration file and replace embedded secret values with named references. Predict the authorization failure before granting a least-privilege role, then remove the reference and role from the exercise. This is a static procedure and not live-verified.
Sources and re-audit
- AZ-204 security objectives, skills measured 2026-01-14; checked 2026-08-31.
- Key Vault overview, checked 2026-08-31.
- Managed identities overview, checked 2026-08-31.
- SAS overview, checked 2026-08-31.
Re-audit when identity, permission, secret, SAS, or configuration behavior changes.