AZ400-Q: Key Vault secrets in a pipeline
Q: A YAML pipeline needs an API key that must never be stored in source control. What is the recommended way to make it available to tasks while keeping it masked?
- A) Hardcode the key in the pipeline YAML
- B) Store the key in Azure Key Vault, link a variable group to that Key Vault, and reference the secret with
$(SecretName)in tasks ✓ - C) Put the key in a
.envfile committed to the repo - D) Have developers paste the key into the pipeline’s variables at run time
Answer: B. The recommended pattern is to store the secret in Azure Key Vault, link a variable group to it, and reference the value by macro ($(SecretName)) in tasks. Azure Pipelines downloads the secret at run time and masks it in logs; it is not stored in or exposed by the repo.
Why it helps
Secure secret handling via Key Vault–linked variable groups is a core “manage secrets with Key Vault” AZ-400 objective.