Tailwind Traders operates a multi-tenant SaaS platform across App Service, Azure Functions, and AKS.
Secrets are currently a single Key Vault shared by every application and environment, and each service authenticates with a client secret stored in app settings. A recent near-miss saw a leaked secret grant access to production storage. Security has mandated that no application store a credential of any kind, and that a compromise of one workload must not expose another's secrets.
The database password must rotate every 60 days with zero downtime. An earlier attempt caused an outage because applications cached the old value and kept presenting a revoked credential.
On the observability side, one Application Insights resource is shared by all services, and during incidents the team cannot tell which service is failing or follow a request across service boundaries. Telemetry ingestion cost has also tripled year on year, and a daily cap was applied that silently created gaps in the data.