When newer versions become available, such as with a rotation event, the app will automatically update and begin using the latest version within 24 hours. The SecretVersion is optional but if present indicates the version of the secret to use.įor example, a complete reference would look like the following: a version is not specified in the reference, then the app will use the latest version that exists in the key vault. The SecretName is required and should be the name of the target secret. The VaultName is required and should the name of your Key Vault resource. VaultName= vaultName SecretName= secretName SecretVersion= secretVersion

The SecretUri should be the full data-plane URI of a secret in Key Vault, optionally including a version, e.g., or To set this, use the following CLI command: az webapp config set -subscription -g -n -generic-configurations ' is replaced by one of the following options: This requirement will be removed in a forthcoming update. Linux applications attempting to use private endpoints additionally require that the app be explicitly configured to have all traffic route through the virtual network. Make sure the application has outbound networking capabilities configured, as described in App Service networking features and Azure Functions networking options.

If your vault is configured with network restrictions, you will also need to ensure that the application has network access. Do not configure the 'authorized application' or applicationId settings, as this is not compatible with a managed identity. Enable the 'Get' secret permission on this policy. Key Vault references will use the app's system assigned identity by default, but you can specify a user-assigned identity.Ĭreate an access policy in Key Vault for the application identity you created earlier. In order to read secrets from Key Vault, you need to have a vault created and give your app permission to access it.Ĭreate a key vault by following the Key Vault quickstart.Ĭreate a managed identity for your application. Azure Key Vault is a service that provides centralized secrets management, with full control over access policies and audit history. This topic shows you how to work with secrets from Azure Key Vault in your App Service or Azure Functions application without requiring any code changes.

Keyvault checker tool v2