Why can someone manage a vault without seeing its secrets?
Azure distinguishes managing the vault from using the data in it. In an Azure role-based setup, choose an appropriate data-access role for the app and separately decide who may manage the vault. A person who can see vault settings does not automatically have the intended app access.
Can a vault backup be restored anywhere?
The documented manual backup handles an individual secret, key or certificate. Microsoft describes the backup as an encrypted file that can be restored to a vault within the same Azure subscription and geography. For a move across those boundaries, plan a separate supported path and preserve the list of roles and consumers.
Which pricing line applies to an app secret?
The current Standard and Premium pricing tables list secret operations per 10,000 transactions. Keys and certificates have different pricing lines. Check the vault type, region and operations you use before comparing plans.
Who needs to read the value in a fictional test vault?
Draw an Azure test vault for a fictional appointment service. Label the running app, the release operator and the person who reviews settings.
- Separate the jobsThe app reads its setting. The operator handles a planned change. The settings reviewer sees the management details needed for their job.
- Check the restore planIf you need a backup, mark the same subscription and geography on the intended restore target. Do this on paper without opening or copying a value.