Azure Key Vault: Secure Your Secrets in .NET Applications

In modern cloud applications, security is not optional. Every application uses secrets like database connection strings, API keys, certificates, and encryption keys. If you store them in configuration files, you risk exposing sensitive data.

This is where Azure Key Vault helps you.

Azure Key Vault is a cloud service that securely stores and manages secrets, keys, and certificates. It protects sensitive data and allows controlled access using Azure Active Directory.

In this article, you will learn:

• What Azure Key Vault is
• Why you should use it
• Real-world use cases
• Core features
• Step-by-step implementation in .NET
• Working code example
• Best practices

Let’s start from the basics.

What is Azure Key Vault?

Azure Key Vault is a centralized secret management service in Microsoft Azure. It helps you:

• Store secrets securely
• Manage encryption keys
• Store SSL certificates
• Control access using Azure AD
• Audit usage

Instead of storing secrets in appsettings.json, you store them safely inside Key Vault.

Why Do We Need Azure Key Vault?

Many developers store secrets in:

• appsettings.json
• Web.config
• Environment variables
• Source code

This is risky because:

• Secrets may get pushed to Git repositories
• Anyone with server access can read them
• Rotating secrets becomes difficult

Azure Key Vault solves these problems.

What Can Azure Key Vault Store?

Azure Key Vault stores three main types:

1️⃣ Secrets

• Database connection strings
• API keys
• Passwords
• Storage account keys

2️⃣ Keys

• RSA keys
• Encryption keys
• Signing keys

3️⃣ Certificates

• SSL certificates
• TLS certificates

Real-World Example

Imagine you build an e-commerce application using:

• Azure App Service
• Azure SQL Database
• Payment gateway API

Your app needs:

• SQL connection string
• Payment API key
• Storage account key

If you store these in your application config file, hackers can access them if your code leaks.

Instead:

1. Store them in Azure Key Vault
2. Give your application access using Managed Identity
3. Retrieve secrets securely at runtime

Now your secrets stay protected.

Core Features of Azure Key Vault

🔐 1. Secure Storage

Azure encrypts all data at rest and in transit.

👤 2. Access Control

You control access using:

• Azure Role-Based Access Control (RBAC)
• Access Policies
• Managed Identity

🔄 3. Secret Versioning

You can rotate secrets without breaking the application.

📊 4. Logging & Monitoring

You can monitor access using Azure Monitor and logs.

🔑 5. Hardware Security Module (HSM)

For high security, you can use HSM-backed keys.

How Azure Key Vault Works

1. You create a Key Vault in Azure.
2. You store secrets inside it.
3. Your application authenticates using Azure AD.
4. The application requests the secret.
5. Key Vault verifies identity.
6. It returns the secret securely.

Step-by-Step Implementation in .NET

Now let’s implement it in a .NET Core application.

We will:

• Create a Key Vault
• Add a secret
• Connect it to .NET
• Retrieve secret

Step 1: Create Azure Key Vault

1. Go to Azure Portal
2. Click Create Resource
3. Search “Key Vault”
4. Create new vault
5. Provide:
   • Name
   • Resource Group
   • Region

After deployment, open the vault.

Step 2: Add a Secret

1. Go to Secrets
2. Click Generate/Import
3. Enter:

Name: SqlConnectionString
Value: Server=xyz;Database=abc;User Id=test;Password=123;

Click Create.

Step 3: Enable Managed Identity (For App Service)

If you use Azure App Service:

1. Go to App Service
2. Select Identity
3. Turn on System Assigned Identity
4. Save

Then:

1. Go to Key Vault
2. Access Control (IAM)
3. Add Role Assignment
4. Select role: Key Vault Secrets User
5. Select your App Service

Now your app can access secrets securely.

Install Required NuGet Packages

In your .NET project, install:

dotnet add package Azure.Identity
dotnet add package Azure.Security.KeyVault.Secrets
dotnet add package Azure.Extensions.AspNetCore.Configuration.Secrets

Working .NET Code Example

Option 1: Using Key Vault in ASP.NET Core (.NET 6/7/8)

Update Program.cs:

using Azure.Identity;

var builder = WebApplication.CreateBuilder(args);

// Add Azure Key Vault
var keyVaultUrl = new Uri("https://<your-keyvault-name>.vault.azure.net/");

builder.Configuration.AddAzureKeyVault(
    keyVaultUrl,
    new DefaultAzureCredential());

var app = builder.Build();

app.MapGet("/", (IConfiguration config) =>
{
    var connectionString = config["SqlConnectionString"];
    return $"Connection String: {connectionString}";
});

app.Run();

Option 2: Fetch Secret Manually

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

var keyVaultUrl = "https://<your-keyvault-name>.vault.azure.net/";
var client = new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential());

KeyVaultSecret secret = await client.GetSecretAsync("SqlConnectionString");

Console.WriteLine($"Secret Value: {secret.Value}");

How Authentication Works

DefaultAzureCredential() works differently depending on environment:

• Local machine → Uses Visual Studio login
• Azure App Service → Uses Managed Identity
• Azure VM → Uses Managed Identity

This makes development easy and secure.

Best Practices

✅ 1. Never Hardcode Secrets

Always store secrets in Key Vault.

✅ 2. Use Managed Identity

Avoid client secrets.

✅ 3. Enable Soft Delete

Prevent accidental deletion.

✅ 4. Rotate Secrets Regularly

Improve security.

✅ 5. Use RBAC Instead of Access Policies (Recommended)

Common Interview Questions

1. What is Azure Key Vault?
2. Difference between Secrets and Keys?
3. How does Managed Identity work?
4. How do you rotate secrets?
5. What is Soft Delete?
6. How do you secure production apps?

When Should You Use Azure Key Vault?

Use it when:

• You deploy to Azure
• You handle sensitive data
• You follow enterprise security standards
• You need compliance (ISO, SOC, GDPR)

Performance Consideration

• Avoid calling Key Vault frequently.
• Cache secrets in memory.
• Use configuration integration instead of manual calls.

Final Thoughts

Azure Key Vault is essential for secure cloud applications. It protects secrets, simplifies management, and improves compliance.

If you build modern .NET applications on Azure, you should always use Azure Key Vault.

It:

• Improves security
• Prevents secret leaks
• Supports enterprise architecture
• Enables secure DevOps

Start using it today and make your applications production-ready and secure.