An App Service app should read a database password from Key Vault through an ordinary app setting, with no code changes. What should the app setting's value be?
- A @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/DbPassword/) (correct answer)
- B The secret's current value, copied from Key Vault
- C keyvault://myvault/DbPassword
- D The Key Vault resource ID
Shortcut: Key Vault secret in an app setting, no code = @Microsoft.KeyVault(SecretUri=...). The identity needs permission to read secrets, such as the Key Vault Secrets User role. Copying the value breaks rotation, and the other formats aren't valid.
A Key Vault reference in the @Microsoft.KeyVault(SecretUri=...) format makes App Service fetch the secret using the app's managed identity and expose it as a normal environment variable. The identity needs permission to read secrets, such as the Key Vault Secrets User role. Copying the value breaks rotation, and the other formats aren't valid.