What Azure Key Vault Actually Does, and When You Need One
It's not just a place to hide passwords, though that's the easy part to explain.
By Shehryar Hassan, Microsoft 365 & Azure Consultant
A client asked me last week why their developer kept talking about "the vault" like it was some separate system. It's not separate, it's just Azure Key Vault, and once you've set one up you wonder how anyone manages secrets without it.
What it actually stores
Key Vault holds three kinds of things: secrets (connection strings, API keys, passwords), keys (used for encryption operations), and certificates. Most small teams only ever touch the secrets tab, and that's fine. The point is that none of these values sit in a config file, a script, or an email thread where anyone with repo access can read them.
Why not just use app settings
You can put a connection string straight into an App Service's application settings, and for a one person project that's probably fine. The trouble starts once more than one person or service needs the same value. If it's in Key Vault, you rotate it in one place and every app that references it picks up the new value automatically, no redeploying, no hunting through five different resources to update the same string.
Access is the part people get wrong
A vault by itself doesn't protect anything if everyone in the subscription can read it. Use Azure RBAC roles scoped to the vault rather than the older access policy model if you're starting fresh, and give each app its own managed identity instead of a shared service principal. That way if one app is compromised, you're not handing over the keys to everything else.
Getting started without overthinking it
Create a vault, turn on soft delete and purge protection (both are basically free insurance against someone fat fingering a delete), and move your first connection string in. Reference it from your App Service using a Key Vault reference instead of pasting the value in directly. Once that's working, move the rest over one at a time.
You don't need Key Vault on day one for a small internal tool. But the moment a second person touches the project, or a secret ends up copied in more than one place, it's worth the ten minutes to set one up.
Get new posts by email
One note when there is something worth reading. No spam, unsubscribe anytime.
Related articles
Five Azure Mistakes Beginners Make
None of these are about lacking technical skill. They're about habits that don't feel important until the moment they suddenly are.
Getting Started With Azure as a Small Business
Start with the specific problem you have, set billing protections immediately, and don't skip basic security just because you're small.
Azure Functions Explained With a Simple Example
A small piece of code that runs when something happens and stops. Here's a real example, from an invoice upload to an automatic email.