Azure Key Vault
What it is
Azure Key Vault is the cloud service for securely storing and controlling access to secrets (connection strings, passwords), keys (encryption keys), and certificates. A Key Vault is the standard place to hold secrets that apps/pipelines need.
Why it exists
Storing secrets in code, config files, or plaintext is a top security failure. Key Vault centralizes secrets behind Entra ID + RBAC access control, rotates them, and keeps them out of code — the foundation of secrets-management.
Key ideas
- Stores — Secrets, Keys (HSM-backed option), Certificates.
- Access control — permissions via an access policy or RBAC; identities access it (service-principal/managed identity) — never via static keys in code.
- Rotation & audit — auto/manual rotation, diagnostics logged.
- Integration — Pipelines reference secrets from Key Vault in variable groups (see secrets-management).
Exam notes
- Key Vault is the “correct” answer whenever a question asks where to store secrets/keys/certs.
- Access via managed identity is the recommended pattern (no stored credentials).
- Also relevant to AZ-104 (app/VM secrets) and AZ-400 (pipeline secrets).
Related
secrets-management · best-practice-secrets · service-principal
Diagram
Diagrams courtesy of Microsoft Learn / Azure docs: key-vault/general/basic-access
📘 Source: Microsoft Learn — Key Vault