Skip to content

Commit fa980b9

Browse files
mrm9084mrm9084
committed
Key Vault Usage Update
1 parent de2dadd commit fa980b9

3 files changed

Lines changed: 216 additions & 82 deletions

File tree

‎articles/azure-app-configuration/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,8 @@
152152
href: use-key-vault-references-dotnet-core.md
153153
- name: Spring Boot
154154
href: use-key-vault-references-spring-boot.md
155+
- name: Python
156+
href: use-key-vault-references-python-provider.md
155157
- name: Reload secrets and certificates automatically
156158
items:
157159
- name: .NET

‎articles/azure-app-configuration/use-key-vault-references-python-provider.md‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
---
2+
title: Tutorial for using Azure App Configuration Key Vault references in a Python app | Microsoft Docs
3+
description: In this tutorial, you learn how to use Azure App Configuration's Key Vault references from a Python app
4+
services: azure-app-configuration
5+
author: mrm9084
6+
ms.service: azure-app-configuration
7+
ms.devlang: python
8+
ms.topic: tutorial
9+
ms.date: 03/16/2026
10+
ms.author: mametcal
11+
ms.custom: devx-track-python, devx-track-azurecli
12+
#Customer intent: I want to update my Python application to reference values stored in Key Vault through App Configuration.
13+
---
14+
15+
# Tutorial: Use Key Vault references in a Python app
16+
17+
In this tutorial, you learn how to implement Key Vault references in a Python application using App Configuration. It builds on the web app introduced in the quickstart. Before you continue, complete [Create a Python app with App Configuration](./quickstart-python-provider.md) first.
18+
19+
In this tutorial, you learn how to:
20+
21+
> [!div class="checklist"]
22+
> * Create an App Configuration key that references a value stored in Key Vault.
23+
> * Access the value of this key from a Python application.
24+
25+
## Prerequisites
26+
27+
* Azure subscription - [create one for free](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn)
28+
* Python 3.8 or later - for information on setting up Python on Windows, see the [Python on Windows documentation](/windows/python/)
29+
* Finish the [Create a Python app with App Configuration](./quickstart-python-provider.md) quickstart.
30+
31+
## Create a key vault
32+
33+
1. Sign in to the [Azure portal](https://portal.azure.com), and then select **Create a resource**.
34+
35+
1. In the search box, enter **Key Vault**. In the result list, select **Key Vault**.
36+
37+
1. On the **Key Vault** page, select **Create**.
38+
39+
1. On the **Create a key vault** page, enter the following information:
40+
- For **Subscription**: Select a subscription.
41+
- For **Resource group**: Enter the name of an existing resource group or select **Create new** and enter a resource group name.
42+
- For **Key vault name**: Enter a unique name.
43+
- For **Region**: Select a location.
44+
45+
1. For the other options, use the default values.
46+
47+
1. Select **Review + create**.
48+
49+
1. After the system validates and displays your inputs, select **Create**.
50+
51+
At this point, your Azure account is the only one authorized to access this new vault.
52+
53+
## Add a secret to Key Vault
54+
55+
Add a secret to the vault to test Key Vault retrieval. The secret is called **Message**, and its value is "Hello from Key Vault."
56+
57+
1. On the Key Vault resource menu, select **Objects** > **Secrets**.
58+
59+
1. Select **Generate/Import**.
60+
61+
1. In the **Create a secret** dialog, enter the following values:
62+
- For **Upload options**: Enter **Manual**.
63+
- For **Name**: Enter **Message**.
64+
- For **Secret value**: Enter **Hello from Key Vault**.
65+
66+
1. For the other options, use the default values.
67+
68+
1. Select **Create**.
69+
70+
## Add a Key Vault reference to App Configuration
71+
72+
1. Sign in to the [Azure portal](https://portal.azure.com). Select **All resources**, and then select your App Configuration store.
73+
74+
1. Select **Configuration Explorer**.
75+
76+
1. Select **+ Create** > **Key vault reference**, and then specify the following values:
77+
* **Key**: Enter **TestApp:Settings:KeyVaultMessage**.
78+
* **Label**: Leave this value blank.
79+
* **Subscription**, **Resource group**, and **Key vault**: Enter the values corresponding to the key vault you created in the previous section.
80+
* **Secret**: Select the secret named **Message** that you created in the previous section.
81+
82+
## Grant your app access to Key Vault
83+
84+
Your application uses `DefaultAzureCredential` to authenticate to both App Configuration and Key Vault. This credential automatically works with managed identities in Azure, and with your developer credentials locally.
85+
86+
1. Grant your identity access to Key Vault. Assign the **Key Vault Secrets User** role to your user account or managed identity:
87+
88+
```azurecli
89+
az role assignment create --role "Key Vault Secrets User" --scope /subscriptions/<subscriptionId>/resourceGroups/<group-name>/providers/Microsoft.KeyVault/vaults/<your-unique-keyvault-name> --assignee <your-azure-ad-user-or-managed-identity>
90+
```
91+
92+
1. Grant your identity access to App Configuration. Assign the **App Configuration Data Reader** role:
93+
94+
```azurecli
95+
az role assignment create --role "App Configuration Data Reader" --scope /subscriptions/<subscriptionId>/resourceGroups/<group-name>/providers/Microsoft.AppConfiguration/configurationStores/<your-app-configuration-store> --assignee <your-azure-ad-user-or-managed-identity>
96+
```
97+
98+
## Update your code to use a Key Vault reference
99+
100+
1. Install the required packages by running the following command:
101+
102+
```console
103+
pip install azure-appconfiguration-provider azure-identity
104+
```
105+
106+
1. Create an environment variable called **AZURE_APPCONFIG_ENDPOINT**. Set its value to the endpoint of your App Configuration store. You can find the endpoint on the **Overview** blade in the Azure portal.
107+
108+
### [Windows command prompt](#tab/cmd)
109+
110+
```cmd
111+
setx AZURE_APPCONFIG_ENDPOINT "endpoint-of-your-app-configuration-store"
112+
```
113+
114+
Restart the command prompt to allow the change to take effect.
115+
116+
### [PowerShell](#tab/powershell)
117+
118+
```powershell
119+
$Env:AZURE_APPCONFIG_ENDPOINT = "endpoint-of-your-app-configuration-store"
120+
```
121+
122+
### [macOS or Linux](#tab/bash)
123+
124+
```bash
125+
export AZURE_APPCONFIG_ENDPOINT='endpoint-of-your-app-configuration-store'
126+
```
127+
128+
---
129+
130+
1. Update your Python application file to load Key Vault references. Create or update a file called *app.py*:
131+
132+
```python
133+
from azure.appconfiguration.provider import load
134+
from azure.identity import DefaultAzureCredential
135+
import os
136+
137+
endpoint = os.environ.get("AZURE_APPCONFIG_ENDPOINT")
138+
credential = DefaultAzureCredential()
139+
140+
# Connect to Azure App Configuration and resolve Key Vault references.
141+
config = load(
142+
endpoint=endpoint,
143+
credential=credential,
144+
keyvault_credential=credential,
145+
)
146+
147+
# Access configuration values, including resolved Key Vault references.
148+
print(config["TestApp:Settings:KeyVaultMessage"])
149+
```
150+
151+
The `keyvault_credential` parameter tells the provider to use the given credential when resolving Key Vault references. The same `DefaultAzureCredential` instance is used for both App Configuration and Key Vault authentication.
152+
153+
> [!NOTE]
154+
> If your Key Vault references point to multiple key vaults that require different credentials, you can use the `keyvault_client_configs` parameter instead to provide per-vault credentials. For more information, see the [Python provider reference](./reference-python-provider.md).
155+
156+
1. Run the application:
157+
158+
```console
159+
python app.py
160+
```
161+
162+
You see the message that you entered in App Configuration. You also see the message that you entered in Key Vault, resolved through the Key Vault reference.
163+
164+
## Clean up resources
165+
166+
[!INCLUDE [azure-app-configuration-cleanup](../../includes/azure-app-configuration-cleanup.md)]
167+
168+
## Next steps
169+
170+
In this tutorial, you created an App Configuration key that references a value stored in Key Vault. To learn more about the Python provider for Azure App Configuration, see the [Python provider reference documentation](./reference-python-provider.md).
171+
172+
> [!div class="nextstepaction"]
173+
> [Python provider reference](./reference-python-provider.md)

‎articles/azure-app-configuration/use-key-vault-references-spring-boot.md‎

Lines changed: 41 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: mrm9084
66
ms.service: azure-app-configuration
77
ms.devlang: java
88
ms.topic: tutorial
9-
ms.date: 02/10/2026
9+
ms.date: 03/16/2026
1010
ms.author: mametcal
1111
ms.custom: mvc, devx-track-java, devx-track-azurecli, devx-track-extended-java
1212
#Customer intent: I want to update my Spring Boot application to reference values stored in Key Vault through App Configuration.
@@ -36,116 +36,75 @@ In this tutorial, you learn how to:
3636
* Azure subscription - [create one for free](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn)
3737
* A supported [Java Development Kit (JDK)](/java/azure/jdk) with version 17.
3838
* [Apache Maven](https://maven.apache.org/download.cgi) version 3.0 or above.
39+
* Finish the [Create a Java Spring app with App Configuration](./quickstart-java-spring-app.md) quickstart.
3940

40-
## Create a vault
41+
## Create a key vault
4142

42-
1. Select the **Create a resource** option in the upper-left corner of the Azure portal:
43+
1. Sign in to the [Azure portal](https://portal.azure.com), and then select **Create a resource**.
4344

44-
![Screenshot shows the Create a resource option in the Azure portal.](./media/quickstarts/search-services.png)
45-
1. In the search box, enter **Key Vault**.
46-
1. From the results list, select **Key vaults**.
47-
1. In **Key vaults**, select **Add**.
48-
1. On the right in **Create key vault**, provide the following information:
49-
* Select **Subscription** to choose a subscription.
50-
* In **Resource Group**, select **Create new** and enter a resource group name.
51-
* In **Key vault name**, a unique name is required. For this tutorial, enter **Contoso-vault2**.
52-
* In the **Region** drop-down list, choose a location.
53-
1. Leave the other **Create key vault** options with their default values.
54-
1. Select **Create**.
45+
1. In the search box, enter **Key Vault**. In the result list, select **Key Vault**.
5546

56-
At this point, your Azure account is the only one authorized to access this new vault.
47+
1. On the **Key Vault** page, select **Create**.
48+
49+
1. On the **Create a key vault** page, enter the following information:
50+
- For **Subscription**: Select a subscription.
51+
- For **Resource group**: Enter the name of an existing resource group or select **Create new** and enter a resource group name.
52+
- For **Key vault name**: Enter a unique name.
53+
- For **Region**: Select a location.
54+
55+
1. For the other options, use the default values.
5756

58-
![Screenshot shows your key vault.](./media/quickstarts/vault-properties.png)
57+
1. Select **Review + create**.
58+
59+
1. After the system validates and displays your inputs, select **Create**.
60+
61+
At this point, your Azure account is the only one authorized to access this new vault.
5962

6063
## Add a secret to Key Vault
6164

62-
To add a secret to the vault, you need to take just a few more steps. In this case, add a message that you can use to test Key Vault retrieval. The message is called **Message**, and you store the value "Hello from Key Vault" in it.
65+
Add a secret to the vault to test Key Vault retrieval. The secret is called **Message**, and its value is "Hello from Key Vault."
66+
67+
1. On the Key Vault resource menu, select **Objects** > **Secrets**.
6368

64-
1. From the Key Vault properties pages, select **Secrets**.
6569
1. Select **Generate/Import**.
66-
1. In the **Create a secret** pane, enter the following values:
67-
* **Upload options**: Enter **Manual**.
68-
* **Name**: Enter **Message**.
69-
* **Value**: Enter **Hello from Key Vault**.
70-
1. Leave the other **Create a secret** properties with their default values.
70+
71+
1. In the **Create a secret** dialog, enter the following values:
72+
- For **Upload options**: Enter **Manual**.
73+
- For **Name**: Enter **Message**.
74+
- For **Secret value**: Enter **Hello from Key Vault**.
75+
76+
1. For the other options, use the default values.
77+
7178
1. Select **Create**.
7279

7380
## Add a Key Vault reference to App Configuration
7481

75-
1. Sign in to the [Azure portal](https://portal.azure.com). Select **All resources**, and then select the App Configuration store instance that you created in the quickstart.
82+
1. Sign in to the [Azure portal](https://portal.azure.com). Select **All resources**, and then select your App Configuration store.
7683

7784
1. Select **Configuration Explorer**.
7885

7986
1. Select **+ Create** > **Key vault reference**, and then specify the following values:
80-
* **Key**: Select **/application/config.keyvaultmessage**
87+
* **Key**: Enter **/application/config.keyVaultMessage**.
8188
* **Label**: Leave this value blank.
82-
* **Subscription**, **Resource group**, and **Key vault**: Enter the values corresponding to the values in the key vault you created in the previous section.
89+
* **Subscription**, **Resource group**, and **Key vault**: Enter the values corresponding to the key vault you created in the previous section.
8390
* **Secret**: Select the secret named **Message** that you created in the previous section.
8491

85-
## Connect to Key Vault
86-
87-
1. In this tutorial, you use a service principal for authentication to Key Vault. To create this service principal, use the Azure CLI [az ad sp create-for-rbac](/cli/azure/ad/sp#az-ad-sp-create-for-rbac) command:
88-
89-
```azurecli
90-
az ad sp create-for-rbac -n "http://mySP" --role Contributor --scopes /subscriptions/{subscription-id} --sdk-auth
91-
```
92+
## Grant your app access to Key Vault
9293

93-
This operation returns a series of key/value pairs:
94-
95-
```json
96-
{
97-
"clientId": "00001111-aaaa-2222-bbbb-3333cccc4444",
98-
"clientSecret": "aaaaaaaa-0b0b-1c1c-2d2d-333333333333",
99-
"subscriptionId": "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e",
100-
"tenantId": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
101-
"activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
102-
"resourceManagerEndpointUrl": "https://management.azure.com/",
103-
"sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
104-
"galleryEndpointUrl": "https://gallery.azure.com/",
105-
"managementEndpointUrl": "https://management.core.windows.net/"
106-
}
107-
```
94+
Your application uses `DefaultAzureCredential` to authenticate to both App Configuration and Key Vault. This credential automatically works with managed identities in Azure, and with your developer credentials locally.
10895

109-
1. Run the following command to let the service principal access your key vault:
96+
1. Grant your identity access to Key Vault. Assign the **Key Vault Secrets User** role to your user account or managed identity:
11097

11198
```azurecli
112-
az keyvault set-policy -n <your-unique-keyvault-name> --spn <clientId-of-your-service-principal> --secret-permissions delete get
99+
az role assignment create --role "Key Vault Secrets User" --scope /subscriptions/<subscriptionId>/resourceGroups/<group-name>/providers/Microsoft.KeyVault/vaults/<your-unique-keyvault-name> --assignee <your-azure-ad-user-or-managed-identity>
113100
```
114101
115-
1. Run the following command to get your object-id, then add it to App Configuration.
102+
1. Grant your identity access to App Configuration. Assign the **App Configuration Data Reader** role:
116103
117104
```azurecli
118-
az ad sp show --id <clientId-of-your-service-principal>
119-
az role assignment create --role "App Configuration Data Reader" --scope /subscriptions/<subscriptionId>/resourceGroups/<group-name> --assignee-principal-type --assignee-object-id <objectId-of-your-service-principal> --resource-group <your-resource-group>
120-
```
121-
122-
1. Create the environment variables **AZURE_CLIENT_ID**, **AZURE_CLIENT_SECRET**, and **AZURE_TENANT_ID**. Use the values for the service principal that were displayed in the previous steps. At the command line, run the following commands and restart the command prompt to allow the change to take effect:
123-
124-
```cmd
125-
setx AZURE_CLIENT_ID "clientId"
126-
setx AZURE_CLIENT_SECRET "clientSecret"
127-
setx AZURE_TENANT_ID "tenantId"
128-
```
129-
130-
If you use Windows PowerShell, run the following command:
131-
132-
```azurepowershell
133-
$Env:AZURE_CLIENT_ID = "clientId"
134-
$Env:AZURE_CLIENT_SECRET = "clientSecret"
135-
$Env:AZURE_TENANT_ID = "tenantId"
105+
az role assignment create --role "App Configuration Data Reader" --scope /subscriptions/<subscriptionId>/resourceGroups/<group-name>/providers/Microsoft.AppConfiguration/configurationStores/<your-app-configuration-store> --assignee <your-azure-ad-user-or-managed-identity>
136106
```
137107
138-
If you use macOS or Linux, run the following command:
139-
140-
```cmd
141-
export AZURE_CLIENT_ID ='clientId'
142-
export AZURE_CLIENT_SECRET ='clientSecret'
143-
export AZURE_TENANT_ID ='tenantId'
144-
```
145-
146-
> [!NOTE]
147-
> These Key Vault credentials are only used within your application. Your application authenticates directly with Key Vault using these credentials without involving the App Configuration service. The Key Vault provides authentication for both your application and your App Configuration service without sharing or exposing keys.
148-
149108
## Update your code to use a Key Vault reference
150109
151110
1. Create an environment variable called **APP_CONFIGURATION_ENDPOINT**. Set its value to the endpoint of your App Configuration store. You can find the endpoint on the **Access Keys** blade in the Azure portal. Restart the command prompt to allow the change to take effect.
@@ -169,15 +128,15 @@ spring:
169128

170129
```properties
171130
spring.config.import=azureAppConfiguration
172-
spring.cloud.azure.appconfiguration.stores[0].endpoint= ${APP_CONFIGURATION_ENDPOINT}
131+
spring.cloud.azure.appconfiguration.stores[0].endpoint=${APP_CONFIGURATION_ENDPOINT}
173132
```
174133

175134
---
176135

177136
> [!NOTE]
178137
> You can also use the [Spring Cloud Azure global configurations](/azure/developer/java/spring-framework/authentication) to connect to Key Vault.
179138
180-
1. Open *MessageProperties.java*. Add a new variable called *keyVaultMessage*:
139+
1. Open *MyProperties.java*. Add a new variable called *keyVaultMessage*:
181140

182141
```java
183142
private String keyVaultMessage;

0 commit comments

Comments
 (0)