Key Vault vs App Configuration: where each value belongs
Verdict: Secrets, keys and certificates go in Key Vault. Non-secret settings and feature flags go in App Configuration. App Configuration holds Key Vault references, not secret copies, and resolves them live through the app's managed identity.
| Criterion | Key Vault | App Configuration |
|---|---|---|
| Stores | Secrets, keys, certificates | Non-secret settings and feature flags |
| Example values | Connection strings, API keys, passwords | Retry counts, endpoint URLs, feature toggles, max page size |
| Secret handling | Holds the secret value | Holds only a Key Vault reference (vault URI); resolves live at load |
| App access | Managed identity plus a data-plane role such as Key Vault Secrets User | Managed identity plus a data-plane role; App Service resolves Key Vault references in app settings with no SDK code |
| Network isolation | Private endpoint plus disable public network access for a no-internet path | Not applicable |
Rules
- App Configuration is purpose-built for centrally managing settings and feature flags across microservices; it complements Key Vault, not replaces it.
- A Key Vault reference in App Configuration stores only the vault URI; the provider resolves it live from Key Vault at load time.
- Store connection strings and third-party API keys in Key Vault; store non-secret settings like page size in App Configuration.
- Give a Container Apps job a managed identity and a data-plane role on App Configuration instead of storing a connection string.
- For a no-internet path to a vault, configure a private endpoint and disable public network access.
- Set an App Service application setting to a Key Vault reference and grant the app's managed identity read access; no SDK code needed.
Traps
- Relocating a connection string into App Configuration still stores a secret; the documented fix is managed identity, not a different store.
- App Configuration does not store secret values itself; it uses Key Vault references.
- Encrypting or auto-rotating a stored secret still stores one; managed identity avoids storing it at all.