Question

Your team stores database connection strings in Azure Key Vault and references them from an Azure Pipelines variable group linked to the vault. The security team requires that when a secret is rotated in Key Vault (for example, after a credential breach), running and future pipeline deployments must pick up the new value without any pipeline YAML edits, without republishing the variable group, and without storing the secret value anywhere in Azure DevOps. Which approach satisfies these requirements?

Accepted Answer

Keep the variable group linked to Key Vault so secrets are fetched at pipeline runtime, and enable secret versioning without pinning a specific version in the reference.

Answer

Copy the secret value into a standard (non-linked) variable group and mark it as secret, then manually update it whenever the Key Vault secret rotates.

Answer

Store the secret as a pipeline YAML variable encrypted with a service connection so it refreshes automatically on each run.

Answer

Pin the variable group reference to a specific secret version GUID so the pipeline always retrieves a consistent, deterministic value.