Decide what to store in App Configuration vs Key Vault

What this covers

Both services hold values that steer an application, but they're built for different data. Exam scenarios often describe a setting and ask where it should live. This page gives the decision test, compares the two services side by side and shows the recommended combined architecture.

Exam weight: Secure, monitor, and troubleshoot Azure solutions (20–25%)

Skills measured

• "Store and retrieve app configuration information by using Azure App Configuration"
• "Secure secrets by using Azure Key Vault, including rotation and retrieval"

Key concepts

The one-question test

Could this value, on its own, let someone reach a resource or do something they shouldn't?

• Yes → Key Vault (as a secret, key or certificate).
• No → App Configuration (as a key-value or feature flag).

What each service is designed for

Rotation and audit

If a value has to rotate on a schedule, expire, and leave a record of who read it, it belongs in Key Vault. Key Vault diagnostic logs (AuditEvent) record every secret read with the caller identity. Changing a batch size or switching a deployment name is an operational change, not a security event, so App Configuration's labels, revision history and refresh fit better.

The complementary pattern

Use App Configuration as the single entry point and Key Vault as the secure back end:

• Plain settings and feature flags live in App Configuration.
• Secrets live in Key Vault and appear in App Configuration as Key Vault references.
• The app calls load() once and gets one dictionary.
• Certificates used for TLS are usually read straight from Key Vault (or bound by the hosting platform), not through App Configuration.

Better still: no secret at all

Where the target service supports Microsoft Entra ID (Azure OpenAI, Cosmos DB, Storage, Service Bus, App Configuration itself), give the app's managed identity a data role and drop the key entirely. Key Vault is for the credentials you can't eliminate.

How it works

Hands-on

Azure portal

1. In App Configuration, create OpenAI:Endpoint and Pipeline:BatchSize as plain key-values.
2. Create a feature flag EnableBatchProcessing.
3. In Key Vault, store openai-api-key; back in App Configuration create a Key Vault reference OpenAI:ApiKey pointing to it.
4. In the vault's Diagnostic settings, send AuditEvent logs to a Log Analytics workspace so secret reads are audited.

Azure CLI

az appconfig kv set --name <store-name> --key "OpenAI:Endpoint" \
  --value "https://<resource>.openai.azure.com/" --yes
az appconfig feature set --name <store-name> --feature EnableBatchProcessing --yes

az keyvault secret set --vault-name <vault-name> --name openai-api-key --value "<api-key>"
az appconfig kv set-keyvault --name <store-name> --key "OpenAI:ApiKey" \
  --secret-identifier "https://<vault-name>.vault.azure.net/secrets/openai-api-key" --yes

az monitor diagnostic-settings create --name kv-audit \
  --resource $(az keyvault show --name <vault-name> --query id -o tsv) \
  --workspace <log-analytics-workspace-id> \
  --logs '[{"category":"AuditEvent","enabled":true}]'

Python

import os
from azure.appconfiguration.provider import load
from azure.identity import DefaultAzureCredential
from featuremanagement import FeatureManager

credential = DefaultAzureCredential()
config = load(
    endpoint=os.environ["AZURE_APPCONFIG_ENDPOINT"],
    credential=credential,
    keyvault_credential=credential,
    feature_flag_enabled=True,
)

settings = {
    "endpoint": config["OpenAI:Endpoint"],         # App Configuration value
    "api_key": config["OpenAI:ApiKey"],            # Key Vault via reference
    "batch_size": int(config["Pipeline:BatchSize"]),
}
batching_on = FeatureManager(config).is_enabled("EnableBatchProcessing")

Exam traps

Quick review

• Values that grant access go to Key Vault; values that tune behavior go to App Configuration.
• Key Vault adds expiry, rotation, per-access audit and HSM protection.
• App Configuration adds labels, feature flags, snapshots and dynamic refresh.
• Recommended pattern: App Configuration as the entry point, Key Vault references for secrets.
• Certificates are read directly from Key Vault.
• Avoid duplicating values across services; avoid hard-coding.
• Prefer managed identity to eliminate secrets where the target supports Entra ID.

Practice

Practice: Azure App Configuration questions

Practice: Azure Key Vault questions

Official references

• Decide what to store in App Configuration vs Key Vault (unit)
• Azure App Configuration best practices
• Azure Key Vault overview
• Key Vault logging