Manage Application Secrets and Configuration for AI Solutions

1. Secrets — Arbitrary String Values

Store any opaque string value: API keys, connection strings, passwords, JWT signing secrets.

• Unique identifier format: https://myvault.vault.azure.net/secrets/secret-name
• Versioned: each update creates a new version. Old versions still retrievable.
• Activatable/deactivatable with date-based access control.

2. Keys — Cryptographic Keys

RSA and EC keys for encryption, signing, and unwrapping. The private key material never leaves Key Vault — your app sends data TO Key Vault for signing/decryption operations, never receives the raw key.

• HSM-backed keys (Premium tier) — hardware security module protection. Highest compliance.
• Operations: sign, verify, encrypt, decrypt, wrapKey, unwrapKey.

3. Certificates — TLS/X.509

Full certificate lifecycle management: create, import, auto-renew (via DigiCert or Let's Encrypt integration). Private key stays in Key Vault. Integrates with App Service for custom domain TLS, API Management, and Application Gateway.

4. Object Type Summary

1. Data Plane Roles — Control What Objects Can Be Read/Written

1. Key Vault Secrets User — read secret values. Assign to managed identity of your AI app. Read-only access to secrets.
2. Key Vault Secrets Officer — full CRUD on secrets (create, update, delete, read, list). Assign to developers and CI/CD pipelines that manage secrets.
3. Key Vault Crypto User — perform crypto operations with keys (sign, decrypt). Does NOT allow reading the raw key material.
4. Key Vault Crypto Officer — manage keys (create, update, delete) + perform operations.
5. Key Vault Certificate User — read certificate values.
6. Key Vault Administrator — full access to ALL data plane operations (secrets + keys + certificates). Use sparingly.

2. Role Assignment Pattern

# Grant AI app read-only access to secrets
az role assignment create \\
  --role "Key Vault Secrets User" \\
  --assignee-object-id $(az containerapp identity show -n ai-api -g rg --query principalId -o tsv) \\
  --scope $(az keyvault show -n myvault --query id -o tsv)

3. Scope Levels

1. Vault level — access to ALL secrets/keys/certs in the vault.
2. Individual secret level — access to only one secret: /subscriptions/.../secrets/secret-name.

1. Basic SDK Pattern

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

credential = DefaultAzureCredential()   # Managed identity in prod, az CLI locally
client = SecretClient(
    vault_url="https://myvault.vault.azure.net",
    credential=credential
)

# Get latest version of a secret
secret = client.get_secret("openai-api-key")
api_key = secret.value

# Get a specific version
specific = client.get_secret("openai-api-key", version="abc123...")

2. Create, Update, and Delete Secrets

client.set_secret("openai-api-key", "sk-abc123")             # Create/update
client.set_secret("openai-api-key", "sk-abc123",             # Set properties
    enabled=True, expires_on=datetime(2026, 12, 31, tzinfo=timezone.utc))

# Disable (deactivate) without deleting
client.update_secret_properties("openai-api-key", enabled=False)

# Delete (soft delete — goes to deleted state, not permanently gone)
client.begin_delete_secret("openai-api-key").result()

# Purge permanently (only after deletion, if purge protection disabled)
client.purge_deleted_secret("openai-api-key")

3. Secret Versioning

Every set_secret() call creates a new version. Old versions remain accessible forever until explicitly deleted. The "latest" version is what get_secret(name) without a version returns.

# List all versions of a secret
versions = list(client.list_properties_of_secret_versions("openai-api-key"))
for v in versions:
    print(v.version, v.enabled, v.expires_on)

4. Implement Caching (Avoid Throttling)

Key Vault has soft rate limits (2,000 secret reads/10 seconds per vault). Fetching secrets on every request causes throttling. Cache secrets locally with expiry:

import time

class SecretCache:
    _cache = {}
    _ttl_seconds = 300  # 5 minutes

    def get(self, name: str) -> str:
        cached = self._cache.get(name)
        if cached and time.time() - cached["fetched_at"] < self._ttl_seconds:
            return cached["value"]
        value = secret_client.get_secret(name).value
        self._cache[name] = {"value": value, "fetched_at": time.time()}
        return value

1. Reference Syntax

# Always-latest version (recommended — auto-rotates)
@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/openai-api-key/)

# Pinned to specific version (does NOT auto-rotate)
@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/openai-api-key/abc123)

2. Setup Steps (Both Required)

1. Assign system-assigned managed identity to App Service
2. Assign Key Vault Secrets User role to the MI on the vault
3. Set app setting value to the @Microsoft.KeyVault(...) reference string
4. App Service resolves the reference and injects the secret value as the env var

3. Soft Delete and Purge Protection

1. Soft delete — always enabled on new vaults. Deleted secrets move to deleted state for 7–90 days before permanent removal. Prevents accidental deletion.
2. Purge protection — prevents permanent deletion during the soft-delete retention period, even by vault owners. Required for compliance (CMEK scenarios).

Load and Read Config

from azure.appconfiguration.provider import load
from azure.identity import DefaultAzureCredential

config = load(
    endpoint="https://mystore.azconfig.io",
    credential=DefaultAzureCredential(),
    refresh_on=[WatchKey("sentinel")],
    refresh_interval=30
)

# Read values like a dict
model = config["OpenAI:Model"]
endpoint = config["OpenAI:Endpoint"]
# Key Vault reference — SDK resolves automatically
api_key = config["OpenAI:ApiKey"]  # stored as KV ref

Enable and Check Feature Flags

from azure.appconfiguration.provider import load

config = load(
    endpoint="https://mystore.azconfig.io",
    credential=DefaultAzureCredential()
)

# Feature flag key format: .appconfig.featureflag/FlagName
semantic_cache_enabled = config.get(
    ".appconfig.featureflag/EnableSemanticCache", False
)

if semantic_cache_enabled:
    result = semantic_cache_get(prompt)
    if result:
        return result

return call_llm(prompt)

Sentinel Pattern

Instead of polling every key, watch one sentinel key. Update all config values first, then update the sentinel last — this triggers a refresh in all running instances atomically.

# Update all settings, then sentinel last
az appconfig kv set -n mystore --key "OpenAI:Model" --value "gpt-4o"
az appconfig kv set -n mystore --key "sentinel" --value "v2"

# SDK watches sentinel, refreshes all config on change
config = load(
    endpoint="https://mystore.azconfig.io",
    credential=DefaultAzureCredential(),
    refresh_on=[WatchKey("sentinel")],
    refresh_interval=30
)