Azure Key Vault is a mechanism for securely saving and accessing secrets. A secret is anything that users want to tightly manage access to, such as API keys, passwords, or certificates. A vault is a legitimate group of secrets. A vault owner can build a key vault and get full access and power over it. The vault owner can also configure auditing to log who obtains secrets and keys. Administrators can check the key lifecycle.

In this hands-on lab, you will learn how to store sensitive data in the azure key vault. You will begin by provisioning an Azure Key Vault and then add an access policy to allow the service principal assigned to the Web App to access secrets. After that, you will add a connection string for a Storage Account as a secret to the Key Vault. Finally, you will update the Web App to use the secret and test that the Web App can retrieve the connection string. The other guided and advanced challenges in this series are “Configure Application Insights” and “Can you Monitor a Web App?”

Understand the Scenario

In this virtual lab, you are a system administrator for a company that provides web hosting services for customers. Your job is to secure sensitive data such as connection strings for a Web App. You will use an Azure Resource Group that contains a preconfigured Storage Account and Web App.

Provision a Key Vault

Azure Key Vault is a cloud setting that gives a reliable store for secrets. Users can securely store various crucial things, such as keys, passwords, certificates, and other secrets. Azure key vaults can be designed and maintained through the Azure portal. In this section of the lab, learners will learn how to provision a key vault. First, they will provide a new Standard tier Key Vault in the resource group and add a new access policy that grants the service principal the right to Get and List secrets. App Services support system-provisioned service principals and user-provisioned service principals. The system-provisioned user principal can be provisioned at the time the App Service is provisioned or later and is tied to the lifetime of the App Service. Finally, they will check and confirm that a Key Vault named kv12650869 is provisioned, and the mms12650869 service principal has access to the Key Vault.

Add a secret to the Key Vault

In this section of the lab, you will now add a secret to the key vault. First, you will navigate to the Access keys page of the sa12650869 Storage Account blade and copy the key1 connection string and paste and open the kv12650869 Key Vault blade to add a Secret named connection and then copy the Secret Identifier of the secret. If you include the version number in the Secret Identifier, you will need to update the Web App if the value of the secret is updated. Finally, you will check and confirm that a secret named connection in the kv12650869 Key Vault contains the connection string to the sa12650869 Storage Account, and the URI of the secret has been recorded.

Configure a Web App to use a secret

In this section, you will learn how to configure a web app to use a secret after adding a secret to the key vault. First, you will navigate to the mms12650869 Web App blade and add an application setting named secretUri that has the Secret Identifier of the connection secret. It may take a minute or more for the site to appear. If you receive a server error, refresh the browser until the site appears. Next, you will select the Test Key Vault button. You should receive a success message. The Web App retrieves the Storage Account connection string from Key Vault, then establishes a connection to the Storage Account and adds messages to a queue in the Storage Account. Finally, you will check and confirm that the mms12650869 Web App has an application setting with the URI of the connection secret, and the mms12650869 Web App successfully retrieves the connection string from the kv12650869 Key Vault.

Lab Summary Conclusion

After completing the “Store Sensitive Data in Azure Key Vault” virtual lab, you will have accomplished the following:

• Provisioned an Azure Key Vault.
• Allowed the service principal for a Web App access to secrets in the Key Vault.
• Stored a connection string as a secret in the Key Vault.
• Accessed the secret from a Web App.

‍