AZ04 · Azure cloud engineering
App Service, Managed Identity & Key Vault
The web app reads a database password from Key Vault using its managed identity: no secret in code.
🎯 You will learn to
- Use managed identity
- Grant least-privilege access
- Remove secrets from config
📘 Guided lab
This mission is a guided walkthrough: follow the steps on your own computer or practice account. The in-browser simulator for it is planned for a later release.
✅ Steps & checkpoints
🗺️ Secret-free workload identity
The app uses its managed (workload) identity to get a short-lived token, then reads the secret from the vault; no secret lives in code or config.
The 2D diagram shows the exact flow, ports and trust boundaries. The 3D scene is a concept view of the same parts; packets travel along the same arrows.
🤔 Think about it
Why is a managed identity safer than a stored key?
🛡️ Safety & cost
Mock mode by default. Real Azure practice is opt-in: use your own subscription, a budget alert and the cleanup steps.
🧹 Cleanup
Delete the lab resource group (az group delete) and check Cost Management the next day.
📚 Reference documents
- Managed identities for Azure resources · Microsoft Learn
- Azure Key Vault overview · Microsoft Learn
- Azure Architecture Center · Microsoft Learn
- Azure resource providers and types · Microsoft Learn
- Azure Well-Architected Framework · Microsoft Learn
Official sources, checked on 5 Nov 2026. Cloud services change often; check the official page before relying on a feature. All references