Question

A company runs an Azure Function app that must encrypt data using customer-managed keys stored in Azure Key Vault. The security team mandates that no credentials, secrets, or connection strings related to Key Vault authentication may be stored in the app's configuration, source code, or environment variables. The Function app is deployed within the same Azure AD tenant as the Key Vault. Which approach should you recommend to authorize the Function app to retrieve keys from Key Vault?

Accepted Answer

Enable a system-assigned managed identity on the Function app and grant it access via a Key Vault access policy or Azure RBAC role assignment.

Answer

Register an Azure AD app registration, generate a client secret, and store the secret in the Function app's application settings for Key Vault authentication.

Answer

Create a service principal with a certificate, upload the certificate to the Function app, and reference it in code to authenticate to Key Vault.

Answer

Store a Key Vault SAS token in an environment variable and rotate it manually every 30 days using an automation runbook.