Using keyvault references for app settings in a webapp with slots not working for the slots

Owin Gruters - iO 46 Reputation points
2024-06-25T14:26:28.2866667+00:00

I have a webapp with 4 slots, default + 3. The appsetings with references to the keyvaults needs to be te same for all slots. Hence a non-slot setting appsetting should do the trick.

But it doesn't. According to this article https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli#source-app-settings-from-key-vault: "most" app settings using key vault references should be marked as slot settings, as you should have separate vaults for each environment.

For my use case this is not the case, but it seems that ALL app settings have to be marked as slot setting, as my code cannot use the app setting value on the slots. (and yes the managed ID of the slot has LIST and GET access to the keyvault)

Is that correct, and if so, can that be changed? I can determine myself is this should be a slot setting or not.

Note that this only applies to appsetting with a keyvault reference, not non-secret values managed in the app settings themselves.

Regards

Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
7,402 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Ben Gimblett 3,845 Reputation points Microsoft Employee
    2024-07-04T14:06:41.6666667+00:00

    This works for me so long as I ensure both the app and the slot
    (a) Is linked to a user msi
    (b) make sure the user msi is assigned to the slot and that keyvault reference knows to use it as per https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli#access-vaults-with-a-user-assigned-identity

    The user MSI is the same for the site and the slot
    Slot
    User's image

    Site
    User's image

    KV REF (identical for site and slot)
    User's image