This is a guide for how to handle secrets in a logic app in a secure way. It combines three resources:

• Accessing Key Vault from Logic App with Managed Identity
• Get Secrets Key Vault API
• Hide your logic apps secrets from prying eyes

First, enable a Managed Identity for your Logic App:

In the KeyVault, add a new Access Policy for the new Managed Identity (from the previous step). Use the least priviliges. In my case it is just enough with GET for secrets.

Using Azure Key Vault in a Pipeline is cool, but it is less secure.

The Key Vault setup

Have you tried the Key Vault Step in an Azure DevOps Pipeline? If you haven’t, please follow these awesome guides:

• Azure DevOps Labs. Using secrets from Azure Key Vault in a pipeline
• Tobias Zimmergren. Using Azure Key Vault Secrets in Azure DevOps pipelines

The steps described in these guides are easy, but that effort made me think about the first pair of pros and cons.