Implement and manage secrets, keys, and certificates by using Azure Key Vault

Three object types, three purposes

Object	Holds	Typical use
Secret	Retrievable bytes, up to 25 KB	Connection strings, API keys, passwords
Key	Cryptographic key used for vault-side operations	Non-exportable signing/decryption designs; normal asymmetric-key retrieval does not return private material
Certificate	Certificate metadata plus addressable key and secret objects	TLS and client authentication; private-key retrieval depends on export policy

When private material must remain in Key Vault, choose a non-exportable key and perform the cryptographic operation through the vault. Normal get operations do not return an asymmetric private key. Attested secure key release to authorized confidential-compute code is a documented exception, so avoid the universal “keys never leave” shorthand.

A Key Vault certificate creates an addressable certificate, key, and secret. Its creation policy must mark the key exportable for the retrieved secret to contain private-key material; a non-exportable policy omits it.

Reaching the vault from a pipeline

Separate secret retrieval from caller authentication:

Key Vault-linked variable group — persists selected secret names, not values, and fetches their current values at runtime.
AzureKeyVault@2 — fetches all or selected secrets at runtime and sets them as variables for later tasks.

For Azure Pipelines, an Azure Resource Manager service connection can use workload identity federation. Code on suitable Azure compute can instead obtain a token through its assigned managed identity and call Key Vault directly. An identity or federation choice enables a retrieval route; it does not fetch the secret by itself.

Rotation and access

Changing the value of an already mapped secret makes its latest value available at runtime. Adding or deleting a secret requires an explicit variable-group mapping update, and the integration supports secrets—not keys or certificates. Runtime jobs still receive secret material even though the linked group does not persist duplicate values.

Enable Key Vault logging through a diagnostic setting and route it to a destination before relying on audit records. Logs can identify the presented identity, operation such as SecretGet, request URI, and result; they do not contain the secret value.

Primary sources

Key Vault for secrets, keys and certificates

Implement and manage secrets, keys, and certificates by using Azure Key Vault

Three object types, three purposes

Reaching the vault from a pipeline

Rotation and access