Store the Azure Function setting inside Azure Key Vault

Question

Store the Azure Function setting inside Azure Key Vault

john john Pter 1,065

I have created a new Project inside Visual Studio 2022, of type Azure Function, I defined 3 parameters inside the local.settings.json (APIUsername + API Password + DBConnectionString) as follow:-

{

**"IsEncrypted": false,**

"Values": {

**"AzureWebJobsStorage": "UseDevelopmentStorage=true",**

**"FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated",**

**"APIUsername": "***",**

**"APIPassword": "****",**

**"DBConnectionString": "**"**

}

Now inside the code i get those values using this

private string connectionString = Environment.GetEnvironmentVariable("DBConnectionString");

private string username = Environment.GetEnvironmentVariable("APIUsername")

private string pass = Environment.GetEnvironmentVariable("APIUsername")

now from VS >> I deployed the code inside Azure Function:-

User's image

Then i got a message that project was successfully deployed... when i access the Azure Function's Configuration, i got this message:-

User's image

so i went to Environment variables >> where i manually created the 3 variables as follow:-

User's image

now to secure those variables , we created 3 secrets inside Azure Key value, and we grant the azure function Reader role on the secrets. but now , how i can configure those 3 environment variables to read their data from azure key vault's secrets?

Second question, is writing the values directly to the environment variables , consider secure? or we better store those inside Azure key vault's secrets ?

Thanks

1 answer

Your answer

Answer 1

chrischin 915 Microsoft Employee

It is more secure to store the secrets in Azure Key Vault.

How did you grant the Function reader role? Did you first enable a managed identity?

As for granting read access:

Confirm the authorization model being used with your Key Vault.

For the older authentication policy model - https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal
For the newer RBAC-based model - https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli

The easiest ways to reference the secrets, is to use this syntax in your App Settings: @Microsoft.KeyVault(SecretUri=<url to your secret in key vault>).

See the entire reference on this here: https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli

john john Pter 1,065 Reputation points

2025-03-18T21:37:08.47+00:00

@chrischin yes the key vault is using role-Based:-

Also i already enabled managed identity for the Azure function.
Ranashekar Guda 2,825 Reputation points Microsoft External Staff Moderator

2025-03-19T18:09:50.2966667+00:00

Hi @john john Pter,

Thanks for bringing back your concern to us, @chrischin Could you share your suggestions on this?
Ranashekar Guda 2,825 Reputation points Microsoft External Staff Moderator

2025-03-20T11:07:38.2266667+00:00
Hello @john john Pter,
You need to grant access to your Azure Functions app so that it can access values from the Azure Key Vault. To do this,

Select the Key Vault, click on the “Access policies” section, and then click on the “Create” button.

Specify the “Get” and “List” permissions for values, then select your Azure Functions app from the list of available options and click on the “Create” button to complete the process.

Retrieve values from Azure Key Vault.

Now that your Azure Functions app has access to the Azure Key Vault, you can retrieve values from it.
chrischin 915 Reputation points Microsoft Employee

2025-03-20T20:46:43.66+00:00

@john john Pter , were you able to update the Azure Key Vault Access Policy with an entry for the Azure Function Identity with permissions to read (Secret Get, List) and reference them in your AppSettings using the @Microsoft notation?
Ranashekar Guda 2,825 Reputation points Microsoft External Staff Moderator

2025-03-24T12:00:17.08+00:00

Hi @john john Pter,
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Ranashekar Guda 2,825 Reputation points Microsoft External Staff Moderator

2025-03-25T09:46:29.6266667+00:00

Hi @john john Pter,

If you had a chance to review my response to your question and found it helpful, please consider clicking "Upvote" on my post. Let us know if you need any further assistance

Share via

Store the Azure Function setting inside Azure Key Vault

1 answer

Your answer