How to Automatically Rotate Secrets with Azure Key Vault and Managed Identity
You are designing a solution to securely store connection strings for an Azure Function app that connects to Azure Service Bus. The connection string contains a Shared Access Key. The company policy requires that secrets be rotated every 90 days and that no secret is stored in source code or configuration files. The solution should minimize operational overhead. What should you use?
Quick Answer
The correct choice is to store the connection string in Azure Key Vault and use a managed identity to access it from the Function app. This solution works because Azure Key Vault provides a centralized, secure vault for secrets, while a managed identity eliminates the need to store, manage, or rotate any credentials in code or configuration files—the Function app authenticates directly to Key Vault without any hardcoded keys. On the Microsoft Azure Developer Associate AZ-204 exam, this scenario tests your understanding of how to combine Key Vault’s built-in secret rotation capabilities with Azure-managed identities to meet strict security policies with minimal operational overhead. A common trap is choosing App Configuration with encryption, which lacks automatic rotation and still requires manual key management. Remember the memory tip: “Managed identity + Key Vault = zero-touch rotation.”
⚠ Common exam trap
Many candidates confuse Azure App Configuration with Azure Key Vault, thinking App Configuration's encryption at rest is sufficient for secrets, but App Configuration lacks secret rotation and managed identity integration for secure access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the connection string in Azure Key Vault and use a managed identity to access it from the Function app.
Azure Key Vault provides a centralized, secure store for secrets like connection strings, and using a managed identity allows the Azure Function app to authenticate to Key Vault without storing any credentials in code or configuration. This approach satisfies the rotation policy by enabling automatic or scheduled secret rotation in Key Vault, and it minimizes operational overhead by eliminating manual credential management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the connection string in Azure Key Vault and use a managed identity to access it from the Function app.
Why this is correct
Key Vault with managed identity provides secure storage, rotation, and no secrets in code.
- ✗
Store the connection string in a JSON configuration file and use Azure Policy to enforce encryption.
Why it's wrong here
Configuration files in source code violate the policy.
- ✗
Store the connection string in Azure App Configuration with encryption at rest using a customer-managed key.
Why it's wrong here
App Configuration does not natively support automatic rotation and still requires managing the key.
- ✗
Store the connection string as an environment variable in the Function app's application settings.
Why it's wrong here
Environment variables are accessible via portal and require manual rotation.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Azure Service Bus
Azure Service Bus is a cloud-based message broker that allows applications, services, and devices to send and receive messages reliably, even when they are not all running at the same time.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to deploy a web app that uses Azure SQL Database. The connection string must be securely stored and automatically rotated without application downtime. What should you use?
easy- A.Store the connection string as an environment variable in the App Service.
- B.Store the connection string in a web.config file with encrypted configuration.
- C.Store the connection string in Azure App Configuration and use a managed identity.
- ✓ D.Store the connection string in Azure Key Vault and configure automatic rotation.
Why D: Azure Key Vault provides centralized, secure storage for secrets like connection strings, and its automatic rotation feature (via Key Vault rotation policies or integration with Azure SQL) allows secrets to be updated without requiring application restarts or downtime. The App Service can access the vault using a managed identity, ensuring the connection string is never exposed in code or configuration files.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.