Use Azure Key Vault secrets in your Pipeline

Article
2025-04-16

Azure DevOps Services | Azure DevOps Server 2022 - Azure DevOps Server 2019

Azure Key Vaults enable developers to securely store and manage sensitive information such as passwords, API keys, and certificates. This article walks you through how to query and use secrets from an Azure Key Vault in your pipeline.

Prerequisites

Product	Requirements
Azure DevOps	- An Azure DevOps project. - Permissions: - To grant access to all pipelines in the project: You must be a member of the Project Administrators group. - To create service connections: You must have the Administrator or Creator role for service connections.
GitHub	- A GitHub account and a GitHub repository. - A GitHub service connection to authorize Azure Pipelines.
Azure	- An Azure subscription.

Sign in to the Azure portal, and then select Create a resource.
Under Key Vault, select Create to create a new Azure Key Vault.
Select your Subscription from the dropdown menu, and then select an existing Resource group or create a new one. Enter a Key vault name, select a Region, choose a Pricing tier, and select Next if you want to configure additional properties. Otherwise, select Review + create to keep the default settings.
Once the deployment is complete, select Go to resource.

First, set your default region and Azure subscription:

Set default subscription:

az account set --subscription <your_subscription_name_or_subscription_ID>

Set default region:

az config set defaults.location=<your_region>

Create a new resource group to host your Azure Key Vault. A resource group is a container that holds related resources for an Azure solution:
```
az group create --name <your-resource-group>
```

Create a new Azure Key Vault:

az keyvault create \
  --name <your-key-vault-name> \
  --resource-group <your-resource-group>

Set up authentication

Managed Identity
Service Principal

Create a user-assigned managed identity

Sign in to the Azure portal, then search for the Managed Identities service in the search bar.
Select Create, and fill out the required fields as follows:
- Subscription: Select your subscription from the dropdown menu.
- Resource group: Select an existing resource group or create a new one.
- Region: Select a region from the dropdown menu.
- Name: Enter a name for your user-assigned managed identity.
Select Review + create when you're done.
Once the deployment is complete, select Go to resource, then copy the Subscription and Client ID, you'll need them in the next steps.
Navigate to Settings > Properties, and copy your managed identity's Tenant ID to use later.

Set up key vault access policies

Navigate to Azure portal, and use the search bar to find the key vault you created earlier.
Select Access policies, then select Create to add a new policy.
Under Secret permissions, select the Get and List checkboxes.
Select Next, then paste the Client ID of the managed identity you created earlier into the search bar.
Select your managed identity, select Next, then Next once more.
Review your new policy, and then select Create when you're done.

Create a service connection

Sign in to your Azure DevOps organization, and then navigate to your project.
Select Project settings > Service connections, and then select New service connection.
Select Azure Resource Manager, then select Next.
Under Identity Type, select Managed identity from the dropdown menu.
For Step 1: Managed identity details, fill out the fields as follows:
- Subscription for managed identity: Select the subscription that contains your managed identity.
- Resource group for managed identity: Select the resource group where your managed identity is hosted.
- Managed Identity: Select your managed identity from the dropdown menu.
For Step 2: Azure Scope, fill out the fields as follows:
- Scope level for service connection: Select Subscription.
- Subscription for service connection: Select the subscription your managed identity will access.
- Resource group for Service connection: (Optional) Specify this if you want to restrict access to a specific resource group.
For Step 3: Service connection details:
- Service connection name: Provide a name for your service connection.
- Service Management Reference: (Optional) Include context information from an ITSM database.
- Description: (Optional) Add a description.
Under Security, check the Grant access permission to all pipelines box to allow all pipelines to use this service connection. If you leave this unchecked, you’ll need to manually grant access for each pipeline.
Select Save to validate and create the service connection.

Create a service principal

In this step, you'll create a new service principal in Azure so that your Azure Pipelines can access Azure Key Vault.

Navigate to Azure portal, then select the >_ icon from the top menu to open the Cloud Shell.
Select either PowerShell or Bash depending on your preference.

Run the following command to create a new service principal:

az ad sp create-for-rbac --name YOUR_SERVICE_PRINCIPAL_NAME

After the command runs, you’ll get an output similar to the following. Copy and save the output, you’ll need it to create a service connection in the next step.

{
  "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
  "displayName": "MyServicePrincipal",
  "password": "***********************************",
  "tenant": "aaaabbbb-0000-cccc-1111-dddd2222eeee"
}

Create a service connection

Sign in to your Azure DevOps organization, and then navigate to your project.
Select Project settings, and then select Service connections.
Select New service connection, select Azure Resource Manager, and then select Next.
Select Service principal (manual), and then select Next.
Under Identity Type, select App registration or managed identity (manual).
Under Credential, select Workload identity federation.
Provide a name for your service connection, and then select Next.
Copy the Issuer and the Subject identifier values. You'll need them in the next step.
For Environment, Select Azure Cloud and for Subscription scope select Subscription.
Enter your Azure Subscription ID and Subscription name.
Under Authentication, paste your service principal's Application (client) ID and Directory (tenant) ID
In the Security section, check the Grant access permission to all pipelines box to allow all pipelines to use this service connection. If you skip this, you’ll need to manually grant access per pipeline.
Leave this page open, you’ll come back to complete it after you've (1) created the federated credential in Azure and (2) granted your service principal Read access at the subscription level.

Create a federated credential in Azure

Navigate to Azure portal, then use the search bar to find your service principal by entering its ClientID. Select the matching Application from the results.
Under Manage, select Certificates & secrets > Federated credentials.
Select Add credential, then for Federated credential scenario, select Other issuer.
In the Issuer field, paste the Issuer value you copied from your service connection earlier.
In the Subject identifier field, paste the Subject identifier you copied earlier.
Enter a Name for your federated credential, and then select Add when you're done.

Add role assignment to your subscription

Before you can verify the connection, you need to grant the service principal Read access at the subscription level:

Navigate to Azure portal
Under Azure services, select Subscriptions, and then find and select your subscription.
Select Access control (IAM), and then select Add > Add role assignment.
Under the Role tab, select Reader, and then select Next.
Select User, group, or service principal, and then select Select members.
In the search bar, paste your service principal's Object ID, select it, then click Select.
Select Review + assign, review your settings, and then select Review + assign again to confirm.
Once the role assignment is added. go back to your service connection in Azure DevOps and select Verify and Save to save your service connection.

Configure Key Vault access policies

Navigate to the Azure portal, find the key vault you created earlier, and then select Access policies.
Select Create, then under Secret permissions add both the Get and List permissions, and then select Next.
Under Principal, paste your service principal's Object ID, select it, and then select Next.
Select Next again, review your settings, and then select Save to apply the new policy.

Query and use secrets in your pipeline

Using the Azure Key Vault task, you can now query and fetch secrets from Azure Key Vault and use them in subsequent tasks in your pipeline. Note that secrets must be explicitly mapped to environment variables, as shown in the following example:

pool:
  vmImage: 'ubuntu-latest'

steps:
- task: AzureKeyVault@1
  inputs:
    azureSubscription: 'SERVICE_CONNECTION_NAME'
    KeyVaultName: 'KEY_VAULT_NAME'
    SecretsFilter: '*'

- bash: |
    echo "Secret Found! $MY_MAPPED_ENV_VAR"        
  env:
    MY_MAPPED_ENV_VAR: $(SECRET_NAME)

The output from the last bash step should look like this:

Secret Found! ***

Note

To query multiple secrets from your Azure Key Vault, use the SecretsFilter input and provide a comma-separated list of secret names, like: 'secret1, secret2'.

Share via

Use Azure Key Vault secrets in your Pipeline

Prerequisites

Create a Key Vault

Set up authentication

Create a user-assigned managed identity

Set up key vault access policies

Create a service connection

Query and use secrets in your pipeline

Related content

Feedback

Additional resources