Azure Key Vault
Complete Guide

# Grant a Managed Identity read access to secrets only (recommended)
az role assignment create \
  --assignee <principal-id-or-object-id> \
  --role "Key Vault Secrets User" \
  --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/\
Microsoft.KeyVault/vaults/<vault-name>

# Grant access to a specific secret only (fine-grained)
az role assignment create \
  --assignee <principal-id> \
  --role "Key Vault Secrets User" \
  --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/\
Microsoft.KeyVault/vaults/<vault-name>/secrets/<secret-name>

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

var vaultUri = new Uri("https://<vault-name>.vault.azure.net/");
var credential = new DefaultAzureCredential();
var client = new SecretClient(vaultUri, credential);

// Set a secret
await client.SetSecretAsync("db-connection-string",
    "Server=myserver.database.windows.net;Database=mydb;...");

// Get latest version
KeyVaultSecret secret = await client.GetSecretAsync("db-connection-string");
Console.WriteLine(secret.Value);

// Get specific version
KeyVaultSecret versionedSecret = await client.GetSecretAsync(
    "db-connection-string",
    "a1b2c3d4e5f6...");

// Set with properties (expiry, content type, tags)
var newSecret = new KeyVaultSecret("api-key", "sk-abcdef123456");
newSecret.Properties.ExpiresOn = DateTimeOffset.UtcNow.AddDays(90);
newSecret.Properties.ContentType = "text/plain";
newSecret.Properties.Tags["Environment"] = "Production";
newSecret.Properties.Tags["ManagedBy"] = "Platform-Team";
await client.SetSecretAsync(newSecret);

// List all secret names
await foreach (SecretProperties props in client.GetPropertiesOfSecretsAsync())
{
    Console.WriteLine($"{props.Name} — Enabled: {props.Enabled}, Expires: {props.ExpiresOn}");
}

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient
from datetime import datetime, timezone, timedelta

credential = DefaultAzureCredential()
client = SecretClient(vault_url="https://<vault>.vault.azure.net/", credential=credential)

# Set a secret
client.set_secret("db-password", "super-secret-password",
    expires_on=datetime.now(timezone.utc) + timedelta(days=90),
    content_type="text/plain",
    tags={"Environment": "Prod"})

# Get a secret
secret = client.get_secret("db-password")
print(secret.value)

# List all secrets
for secret_props in client.list_properties_of_secrets():
    print(f"{secret_props.name}: expires {secret_props.expires_on}")

# Create a secret
az keyvault secret set \
  --vault-name myKeyVault \
  --name "db-password" \
  --value "P@ssw0rd!Secure" \
  --expires "2026-12-31T00:00:00Z"

# Show a secret value
az keyvault secret show \
  --vault-name myKeyVault \
  --name "db-password" \
  --query value -o tsv

# List all secrets
az keyvault secret list --vault-name myKeyVault --query "[].name" -o table

# Delete (soft delete — restorable)
az keyvault secret delete --vault-name myKeyVault --name "db-password"

# Restore soft-deleted secret
az keyvault secret recover --vault-name myKeyVault --name "db-password"

# Permanently purge (requires purge protection to be off)
az keyvault secret purge --vault-name myKeyVault --name "db-password"

using Azure.Security.KeyVault.Keys;
using Azure.Security.KeyVault.Keys.Cryptography;

var keyClient = new KeyVaultClient(vaultUri, credential);

// Create RSA 4096-bit key (HSM-protected on Premium)
var rsaKey = new CreateRsaKeyOptions("my-rsa-key")
{
    KeySize = 4096,
    KeyOperations = { KeyOperation.Encrypt, KeyOperation.Decrypt, KeyOperation.Sign, KeyOperation.Verify },
    ExpiresOn = DateTimeOffset.UtcNow.AddYears(1),
    HardwareProtected = true  // HSM-backed (Premium tier required)
};
KeyVaultKey key = await keyClient.CreateRsaKeyAsync(rsaKey);

// Create EC key for signing
var ecKey = new CreateEcKeyOptions("my-ec-key")
{
    CurveName = KeyCurveName.P256,
    KeyOperations = { KeyOperation.Sign, KeyOperation.Verify }
};
await keyClient.CreateEcKeyAsync(ecKey);

// Encrypt data
var cryptoClient = new CryptographyClient(key.Id, credential);
byte[] plaintext = Encoding.UTF8.GetBytes("sensitive data");
EncryptResult encryptResult = await cryptoClient.EncryptAsync(
    EncryptionAlgorithm.RsaOaep256, plaintext);

// Decrypt data
DecryptResult decryptResult = await cryptoClient.DecryptAsync(
    EncryptionAlgorithm.RsaOaep256, encryptResult.Ciphertext);
string decrypted = Encoding.UTF8.GetString(decryptResult.Plaintext);

// Sign data
SignResult signResult = await cryptoClient.SignDataAsync(
    SignatureAlgorithm.RS256, Encoding.UTF8.GetBytes("data to sign"));

// Verify signature
VerifyResult verifyResult = await cryptoClient.VerifyDataAsync(
    SignatureAlgorithm.RS256,
    Encoding.UTF8.GetBytes("data to sign"),
    signResult.Signature);
Console.WriteLine($"Valid: {verifyResult.IsValid}");

using Azure.Security.KeyVault.Certificates;

var certClient = new CertificateClient(vaultUri, credential);

var certPolicy = new CertificatePolicy("Self", "CN=myapp.contoso.com")
{
    ValidityInMonths = 12,
    ReuseKey = false,
    CertificateTransparency = false,
    ContentType = CertificateContentType.Pkcs12,
    KeyType = CertificateKeyType.Rsa,
    KeySize = 2048,
    KeyUsage = { CertificateKeyUsage.DigitalSignature, CertificateKeyUsage.KeyEncipherment },
    LifetimeActions =
    {
        // Auto-renew 30 days before expiry
        new LifetimeAction(CertificatePolicyAction.AutoRenew)
        {
            DaysBeforeExpiry = 30
        }
    }
};

// Begin certificate creation (async operation)
CertificateOperation operation = await certClient.StartCreateCertificateAsync(
    "my-tls-cert", certPolicy);

// Wait for completion
KeyVaultCertificateWithPolicy cert = await operation.WaitForCompletionAsync();
Console.WriteLine($"Cert thumbprint: {Convert.ToHexString(cert.Properties.X509Thumbprint)}");

# Enable on App Service
az webapp identity assign \
  --resource-group myRG \
  --name myAppService

# Enable on Function App
az functionapp identity assign \
  --resource-group myRG \
  --name myFunctionApp

# Enable on AKS node pool (for pod identity)
az aks update \
  --resource-group myRG \
  --name myAKS \
  --enable-managed-identity

# Assign Key Vault Secrets User to the identity
az role assignment create \
  --assignee $(az webapp identity show --resource-group myRG --name myApp --query principalId -o tsv) \
  --role "Key Vault Secrets User" \
  --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/<vault>

# Create private endpoint for Key Vault
az network private-endpoint create \
  --name myKVPrivateEndpoint \
  --resource-group myRG \
  --vnet-name myVNet \
  --subnet mySubnet \
  --private-connection-resource-id \
    /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/<vault> \
  --group-ids vault \
  --connection-name myKVConnection

# Create Private DNS Zone for Key Vault
az network private-dns zone create \
  --resource-group myRG \
  --name "privatelink.vaultcore.azure.net"

# Link DNS zone to VNet
az network private-dns link vnet create \
  --resource-group myRG \
  --zone-name "privatelink.vaultcore.azure.net" \
  --name myDNSLink \
  --virtual-network myVNet \
  --registration-enabled false

# Create vault with purge protection (recommended for production)
az keyvault create \
  --resource-group myRG \
  --name myKeyVault \
  --location eastus \
  --enable-purge-protection true \
  --retention-days 90 \
  --enable-rbac-authorization true

# Enable purge protection on existing vault
az keyvault update \
  --resource-group myRG \
  --name myKeyVault \
  --enable-purge-protection true

# Latest version (always resolves to current active version)
https://<vault>.vault.azure.net/secrets/<name>

# Specific version (immutable — always returns that version)
https://<vault>.vault.azure.net/secrets/<name>/<version-id>

# Example
https://myvault.vault.azure.net/secrets/db-password
https://myvault.vault.azure.net/secrets/db-password/a1b2c3d4e5f6789012345678901234ab

// Event Grid fires this event when a secret is near expiry
{
  "id": "...",
  "topic": "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/<vault>",
  "subject": "db-password",
  "eventType": "Microsoft.KeyVault.SecretNearExpiry",
  "data": {
    "Id": "https://<vault>.vault.azure.net/secrets/db-password/<version>",
    "VaultName": "<vault>",
    "ObjectType": "Secret",
    "ObjectName": "db-password",
    "Version": "<version>",
    "NBF": null,
    "EXP": 1893456000
  }
}

[FunctionName("RotateSecret")]
public static async Task Run(
    [EventGridTrigger] EventGridEvent eventGridEvent,
    ILogger log)
{
    var secretName = eventGridEvent.Subject;
    log.LogInformation($"Rotating secret: {secretName}");

    // 1. Generate new credential at the source system (DB, API, etc.)
    var newPassword = await GenerateNewDbPasswordAsync();

    // 2. Update the secret in Key Vault with new version
    var secretClient = new SecretClient(
        new Uri("https://<vault>.vault.azure.net/"),
        new DefaultAzureCredential());

    var newSecret = new KeyVaultSecret(secretName, newPassword);
    newSecret.Properties.ExpiresOn = DateTimeOffset.UtcNow.AddDays(90);
    await secretClient.SetSecretAsync(newSecret);

    log.LogInformation($"Secret {secretName} rotated successfully");
    // Apps using the latest-version URI will pick up new value on next read
}

{
  "Get_DB_password": {
    "type": "ApiConnection",
    "inputs": {
      "host": {
        "connection": {
          "name": "@parameters('$connections')['keyvault']['connectionId']"
        }
      },
      "method": "get",
      "path": "/secrets/@{encodeURIComponent('db-password')}/value"
    }
  },
  "Call_Database": {
    "type": "Http",
    "inputs": {
      "method": "POST",
      "uri": "https://myapi.contoso.com/data",
      "headers": {
        "X-DB-Password": "@body('Get_DB_password')?['value']"
      }
    },
    "runAfter": { "Get_DB_password": ["Succeeded"] }
  }
}

# App Setting value format for Key Vault reference
@Microsoft.KeyVault(SecretUri=https://<vault>.vault.azure.net/secrets/<name>/<version>)

# Or always latest version:
@Microsoft.KeyVault(VaultName=<vault>;SecretName=<name>)

# Example in Azure Portal → Function App → Configuration:
# Name:  DB_CONNECTION_STRING
# Value: @Microsoft.KeyVault(VaultName=myVault;SecretName=db-connection-string)

# Set Key Vault reference via CLI
az functionapp config appsettings set \
  --resource-group myRG \
  --name myFunctionApp \
  --settings "DB_CONNECTION_STRING=@Microsoft.KeyVault(VaultName=myVault;SecretName=db-connection-string)"

[FunctionName("ProcessData")]
public static async Task<IActionResult> Run(
    [HttpTrigger(AuthorizationLevel.Function, "post")] HttpRequest req,
    ILogger log)
{
    // Option 1: Read from App Settings (Key Vault reference resolved by platform)
    string connectionString = Environment.GetEnvironmentVariable("DB_CONNECTION_STRING");

    // Option 2: Read directly from Key Vault via SDK
    var kvClient = new SecretClient(
        new Uri("https://myvault.vault.azure.net/"),
        new DefaultAzureCredential()); // Uses Function App's Managed Identity

    KeyVaultSecret secret = await kvClient.GetSecretAsync("api-key");
    string apiKey = secret.Value;

    return new OkObjectResult("Processed");
}

# Enable identity on App Service
az webapp identity assign --resource-group myRG --name myWebApp
PRINCIPAL_ID=$(az webapp identity show --resource-group myRG --name myWebApp --query principalId -o tsv)

# Grant access to Key Vault
az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Key Vault Secrets User" \
  --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/myVault

# Set Key Vault reference as app setting
az webapp config appsettings set \
  --resource-group myRG \
  --name myWebApp \
  --settings "STRIPE_API_KEY=@Microsoft.KeyVault(VaultName=myVault;SecretName=stripe-api-key)"

resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
  name: 'myapp'
  identity: { type: 'SystemAssigned' }
  properties: {
    configuration: {
      secrets: [
        {
          name: 'db-password'
          keyVaultUrl: 'https://myvault.vault.azure.net/secrets/db-password'
          identity: 'system'  // Use system-assigned identity
        }
      ]
    }
    template: {
      containers: [{
        env: [
          { name: 'DB_PASSWORD', secretRef: 'db-password' }
        ]
      }]
    }
  }
}

# Enable CSI driver add-on on AKS
az aks enable-addons \
  --resource-group myRG \
  --name myAKS \
  --addons azure-keyvault-secrets-provider

# Enable Workload Identity
az aks update \
  --resource-group myRG \
  --name myAKS \
  --enable-workload-identity \
  --enable-oidc-issuer

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-keyvault-secrets
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    useVMManagedIdentity: "false"
    clientID: "<workload-identity-client-id>"
    keyvaultName: "myVault"
    cloudName: ""
    objects: |
      array:
        - |
          objectName: db-password
          objectType: secret
          objectVersion: ""
        - |
          objectName: my-tls-cert
          objectType: cert
          objectVersion: ""
    tenantId: "<tenant-id>"
  secretObjects:
    - secretName: app-secrets
      type: Opaque
      data:
        - objectName: db-password
          key: DB_PASSWORD

name: Deploy with Key Vault Secrets
on:
  push:
    branches: [main]

permissions:
  id-token: write   # Required for OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - name: Login to Azure (OIDC — no secrets stored in GitHub)
      uses: azure/login@v1
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

    - name: Get secrets from Key Vault
      uses: azure/get-keyvault-secrets@v1
      with:
        keyvault: myKeyVault
        secrets: 'db-connection-string, stripe-api-key, jwt-signing-key'
      id: kvSecrets

    - name: Deploy
      run: |
        # Secrets available as env vars: DB-CONNECTION-STRING, STRIPE-API-KEY, etc.
        echo "Deploying with retrieved secrets..."
      env:
        DB_CONN: ${{ steps.kvSecrets.outputs.db-connection-string }}

- task: AzureKeyVault@2
  displayName: 'Get Key Vault Secrets'
  inputs:
    azureSubscription: 'myServiceConnection'
    KeyVaultName: 'myKeyVault'
    SecretsFilter: 'db-password,api-key,jwt-secret'
    RunAsPreJob: true

# Secrets now available as pipeline variables: $(db-password), $(api-key)
- script: echo "Deploying..."
  env:
    DB_PASS: $(db-password)

AzureDiagnostics
| where ResourceType == "VAULTS"
| where ResultType != "Success"
| where OperationName in ("SecretGet", "KeySign", "CertificateGet")
| project TimeGenerated, OperationName, ResultType, CallerIpAddress,
          identity_claim_appid_g, requestUri_s
| order by TimeGenerated desc

AzureDiagnostics
| where ResourceType == "VAULTS"
| where OperationName == "SecretGet"
| where id_s contains "db-password"
| project TimeGenerated, CallerIpAddress,
          identity_claim_appid_g,
          identity_claim_oid_g,
          requestUri_s, ResultType
| order by TimeGenerated desc

az monitor diagnostic-settings create \
  --resource /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/<vault> \
  --name "kv-audit-logs" \
  --workspace <log-analytics-workspace-id> \
  --logs '[{"category":"AuditEvent","enabled":true,"retentionPolicy":{"enabled":true,"days":365}}]' \
  --metrics '[{"category":"AllMetrics","enabled":true}]'

# Create Managed HSM
az keyvault create \
  --hsm-name myManagedHSM \
  --resource-group myRG \
  --location eastus \
  --sku Standard_B1 \
  --administrators <admin-object-id>

# Activate (download security domain — required first time)
# This is a ceremony requiring 3+ security domain officers
az keyvault security-domain download \
  --hsm-name myManagedHSM \
  --sd-wrapping-keys cert1.cer cert2.cer cert3.cer \
  --sd-quorum 2 \
  --security-domain-file sd.json