Question

Contoso runs a set of Azure App Service web apps that connect to Azure SQL Database and Azure Storage. Currently, connection strings and access keys are stored in application configuration settings. The security team requires that no credentials be stored in code or app configuration, that credentials be automatically rotated where possible, and that access to storage and databases require no static secrets. Which approach should you recommend?

Accepted Answer

Enable system-assigned managed identities on the App Service apps and grant them Azure RBAC roles on the SQL databases and storage accounts, eliminating static secrets.

Answer

Move all connection strings and keys into Azure Key Vault and reference them from app configuration using Key Vault references authenticated by a shared service principal secret.

Answer

Store the credentials in Azure App Configuration with customer-managed key encryption and enable soft delete.

Answer

Configure Azure Storage account keys and SQL passwords to rotate every 30 days via an Azure Automation runbook and update the app settings after each rotation.