Azure Learning

Manage secrets using Azure Key Vault

Properties1
tagsaz-400, module, secrets, keyvault

2 min read

Manage Secrets Using Azure Key Vault

MS Learn path: Implement secure continuous deployment — module 2.

Overview

Where to hold the credentials a pipeline needs. Covers Azure Key Vault as the centralized secret store, how to grant the pipeline access, and how to surface secrets as variables so they’re consumed by reference — never embedded.

Units

  • Why a dedicated secret store (vs files/repo)
  • Azure Key Vault: secrets, keys, certificates, access policies
  • Granting a pipeline/service connection access to the vault
  • Exposing vault secrets to pipelines as variables

Concepts introduced

Key terms & commands

  • az keyvault create/set/secret/list — create vault, store a secret.
  • Access policy (or RBAC) on the vault controls who may read/write secrets.
  • Secret-variable: pipeline variables whose values are masked and never returned by the API.
  • Link a variable group to the vault so each variable maps to a named secret, fetched at runtime.

Hands-on

⚠ verify — add: create a Key Vault, add a secret, create a Key Vault-linked variable group, consume it in a pipeline variables: - group.

Exam focus

  • Secrets live in Key Vault; pipelines reference by variable group, not embed.
  • Runtime fetch enables rotation without a rebuild.
  • Access is governed by access policies/RBAC and restricted to the service connection (least privilege).

secrets-management · variables-groups · best-practice-secrets · secure-cd · Path MOC

Graph View

Backlinks