Key Vault access patterns for apps

Overview

Azure Key Vault stores secrets, keys, and certificates. Misconfigured access is a common audit finding and breach accelerator.

Patterns

• Managed identities (system or user-assigned) for Azure-hosted apps—no client secrets in App Service settings.
• Private Link to Key Vault when traffic must stay off public endpoints; DNS zone integration documented in network diagram.
• RBAC vs Access Policies: prefer Azure RBAC on new deployments; migrate legacy access policies with a tracked project.

Operations

• Rotation: app registration secrets and SQL passwords via automation where possible; calendar reminders where not.
• Firewall: default deny; allow trusted Azure services only when justified and logged.
• Logging: enable diagnostic logs for authentication failures; alert on spikes.

Pitfalls

Technicians pasting vault URLs into tickets, shared “break glass” identities without PIM, and certificate renewals that silent-fail until TLS breaks—monitor certificate expiry in Defender for Cloud or a dedicated job.