Microsoft Azure Developer Associate AZ-204 Practice Question

Key Vault references allow an App Service app to resolve a secret value at runtime by reading it from Azure Key Vault. A reference is placed directly in an application setting using the syntax @Microsoft.KeyVault(SecretUri=<secretUriWithVersion>). For the platform to read the secret, the web app needs permission to the vault. The simplest secure way is to enable a system-assigned managed identity on the web app and grant that identity the Get permission for secrets in the vault. No code changes are required because the configuration key name remains the same, and the platform resolves the reference before injecting it into the app process.

Adding the raw value to web.config does not satisfy the requirement to move the secret out of the app. Using a SAS token is impossible because Key Vault does not support SAS; it uses Azure AD-based access control. Storing the secret in Azure App Configuration would still require application code (or a configuration provider) to fetch the value, contradicting the "no code changes" constraint.