Note

Access to this page requires authorization. You can try signing in or .

Access to this page requires authorization. You can try .

Use Azure Key Vault secrets in your pipeline

Azure DevOps Services | Azure DevOps Server | Azure DevOps Server 2022

Developers can use Azure key vaults to securely store and manage sensitive information such as passwords, API keys, and certificates. This article walks you through how to query and use secrets from an Azure key vault in your pipeline.

Prerequisites

Product	Requirements
Azure DevOps	- An Azure DevOps project. - Permissions: - To grant access to all pipelines in the project: You must be a member of the Project Administrators group. - To create service connections: You must have the Administrator or Creator role for service connections.
GitHub	- A GitHub account and a GitHub repository. - A GitHub service connection to authorize Azure Pipelines.
Azure	- An Azure subscription.

Create a key vault

Sign in to the Azure portal, and then select Create a resource.
Under Key Vault, select Create to create a new Azure key vault.
Select your subscription from the dropdown menu, and then select an existing resource group or create a new one. Enter a key vault name, select a region, choose a pricing tier, and select Next if you want to configure more properties. Otherwise, select Review + create to keep the default settings.
After the deployment is finished, select Go to resource.

First, set your default region and Azure subscription:

Set default subscription:

az account set --subscription <your_subscription_name_or_subscription_ID>

Set default region:

az config set defaults.location=<your_region>

Create a new resource group to host your Azure key vault. A resource group is a container that holds related resources for an Azure solution:
```
az group create --name <your-resource-group>
```

Create a new Azure key vault:

az keyvault create \
 --name <your-key-vault-name> \
 --resource-group <your-resource-group>

Set up authentication

Create a user-assigned managed identity

Sign in to the Azure portal, and then search for the Managed Identities service in the search bar.
Select Create, and then fill out the required fields:
- Subscription: Select your subscription from the dropdown menu.
- Resource group: Select an existing resource group or create a new one.
- Region: Select a region from the dropdown menu.
- Name: Enter a name for your user-assigned managed identity.
Select Review + create after you're finished.
After the deployment is finished, select Go to resource. Copy the subscription and client ID because you need them in the next steps.
Go to Settings > Properties, and copy your managed identity Tenant ID to use later.

Set up key vault access policies

Go to the Azure portal, and use the search bar to find the key vault that you created earlier.
Select Access policies, and then select Create to add a new policy.
Under Secret permissions, select the Get and List checkboxes.
Select Next, and then paste the client ID of the managed identity that you created earlier into the search bar.
Select your managed identity, select Next, and then Next again.
Review your new policy, and then select Create after you're finished.

Create a service connection

Sign in to your Azure DevOps organization, and then go to your project.
Select Project settings > Service connections, and then select New service connection.
Select Azure Resource Manager, and then select Next.
Under Identity Type, select Managed identity from the dropdown menu.
For Step 1: Managed identity details, fill out the fields:
- Subscription for managed identity: Select the subscription that contains your managed identity.
- Resource group for managed identity: Select the resource group where your managed identity is hosted.
- Managed identity: Select your managed identity from the dropdown menu.
For Step 2: Azure Scope, fill out the fields:
- Scope level for service connection: Select Subscription.
- Subscription for service connection: Select the subscription that your managed identity accesses.
- Resource group for service connection: (Optional) Specify this item if you want to restrict access to a specific resource group.
For Step 3: Service connection details, fill out the fields:
- Service connection name: Enter a name for your service connection.
- Service management reference: (Optional) Include context information from an ITSM database.
- Description: (Optional) Add a description.
Under Security, select the Grant access permission to all pipelines checkbox to allow all pipelines to use this service connection. If you leave this checkbox blank, you need to manually grant access for each pipeline.
Select Save to validate and create the service connection.

👁 Screenshot that shows how to create a managed identity Azure Resource Manager service connection.

Create a service principal

In this step, you create a new service principal in Azure so that your pipelines can access Azure Key Vault.

Go to the Azure portal, and then select the >_ icon from the top menu to open Azure Cloud Shell.
Select either PowerShell or Bash, depending on your preference.

Run the following command to create a new service principal:

az ad sp create-for-rbac --name YOUR_SERVICE_PRINCIPAL_NAME

After the command runs, you get an output similar to the following example. Copy and save the output because you need it to create a service connection in the next step.

{
 "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
 "displayName": "MyServicePrincipal",
 "password": "***********************************",
 "tenant": "aaaabbbb-0000-cccc-1111-dddd2222eeee"
}

Create a service connection

Sign in to your Azure DevOps organization, and then go to your project.
Select Project settings, and then select Service connections.
Select New service connection > Azure Resource Manager, and then select Next.
Select Service principal (manual), and then select Next.
Under Identity Type, select App registration or managed identity (manual).
Under Credential, select Workload identity federation.
Provide a name for your service connection, and then select Next.
Copy the Issuer and the Subject identifier values because you need them in the next step.
For Environment, select Azure Cloud. For Subscription scope, select Subscription.
Enter your Azure subscription ID and subscription name.
Under Authentication, paste your service principal Application (client) ID and Directory (tenant) ID values.
In the Security section, select the Grant access permission to all pipelines checkbox to allow all pipelines to use this service connection. If you skip this step, you need to manually grant access per pipeline.
Leave this page open. You come back to finish it after you create the federated credential in Azure and grant your service principal Read access at the subscription level.

👁 Screenshot that shows how to create an Azure Resource Manager service connection by using App registration.

Create a federated credential in Azure

Go to the Azure portal, and then use the search bar to find your service principal by entering its client ID. Select the matching application from the results.
Under Manage, select Certificates & secrets > Federated credentials.
Select Add credential, and then for Federated credential scenario, select Other issuer.
In the Issuer field, paste the Issuer value that you copied from your service connection earlier.
In the Subject identifier field, paste the subject identifier that you copied earlier.
Enter a name for your federated credential, and then select Add after you're finished.

👁 Screenshot that shows how to create a federated credential for a service principal in Azure.

Add a role assignment to your subscription

Before you can verify the connection, you need to grant the service principal Read access at the subscription level:

Go to the Azure portal.
Under Azure services, select Subscriptions, and then find and select your subscription.
Select Access control (IAM), and then select Add > Add role assignment.
Under the Role tab, select Reader, and then select Next.
Select User, group, or service principal, and then choose Select members.
In the search bar, paste your service principal's object ID, select it, and then choose Select.
Select Review + assign, review your settings, and then select Review + assign again to confirm.
After the role assignment is added, go back to your service connection in Azure DevOps and select Verify and Save to save your service connection.

Configure key vault access policies

Go to the Azure portal, find the key vault that you created earlier, and then select Access policies.
Select Create, and then under Secret permissions, add both the Get and List permissions, and then select Next.
Under Principal, paste your service principal's object ID, select it, and then select Next.
Select Next again, review your settings, and then select Save to apply the new policy.

Query and use secrets in your pipeline

With the Azure Key Vault task, you can now query and fetch secrets from your key vault and use them in subsequent tasks in your pipeline. Secrets must be explicitly mapped to environment variables, as shown in the following example:

pool:
 vmImage: 'ubuntu-latest'

steps:
- task: AzureKeyVault@2 # Download Azure Key Vault secrets.
 inputs:
 azureSubscription: 'SERVICE_CONNECTION_NAME' # Name of the service connection. Alias: ConnectedServiceName.
 KeyVaultName: 'KEY_VAULT_NAME' # Name of the key vault.
 SecretsFilter: '*' # Secrets filter. Default: *.

- bash: |
 echo "Secret Found! $MY_MAPPED_ENV_VAR" 
 env:
 MY_MAPPED_ENV_VAR: $(SECRET_NAME)

The output from the last Bash step should look like this example:

Secret Found! ***

Note

To query multiple secrets from your key vault, use the SecretsFilter input and provide a comma-separated list of secret names, like 'secret1, secret2'.

Feedback

Was this page helpful?

Additional resources

Last updated on

URL: https://learn.microsoft.com/en-us/azure/devops/pipelines/release/key-vault-in-own-project?view=azure-devops

⇱ Query and Use Azure Key Vault Secrets in Your Pipeline - Azure Pipelines | Microsoft Learn

Use Azure Key Vault secrets in your pipeline

Prerequisites

Create a key vault

Set up authentication

Create a user-assigned managed identity

Set up key vault access policies

Create a service connection

Create a service principal

Create a service connection

Create a federated credential in Azure

Add a role assignment to your subscription

Configure key vault access policies

Query and use secrets in your pipeline

Related content

Feedback

Additional resources