Question

Your team deploys an Azure AI Foundry-based agent application to Azure App Service. A security audit mandates that no API keys or connection strings appear in application configuration, source code, or environment variables when the app calls Azure OpenAI and Azure AI Search. The solution must minimize credential management overhead in production. What should you implement?

Accepted Answer

Enable a system-assigned managed identity on the App Service and grant it the appropriate Azure RBAC roles on the Azure OpenAI and Azure AI Search resources, then use token-based authentication in code

Answer

Store the Azure OpenAI and Azure AI Search keys in Azure Key Vault and reference them via Key Vault references in App Service configuration

Answer

Rotate the API keys automatically every 24 hours using an Azure Function and inject them as environment variables at startup

Answer

Create a service principal with a client secret and store the secret in an encrypted App Service application setting