Use Azure Key Vault secrets in Azure Pipelines

Create a user-assigned managed identity

1. Go to the Azure portal, and then search for Managed Identities in the search bar.

2. Select Create, and provide the following information:

   • Subscription: Select your Azure subscription from the dropdown menu.
   • Resource group: Select an existing resource group or create a new one.
   • Region: Select the region where the managed identity is created.
   • Name: Enter a name for the user-assigned managed identity.

3. Select Review + create, and then select Create to start the deployment.

4. After the deployment finishes, select Go to resource, and copy the Subscription ID and Client ID values. You need these values in later steps.

5. Under Settings, select Properties, and copy your managed identity's Tenant ID value for later use.

Set up key vault access policies

1. Go to the Azure portal, and use the search bar to locate the key vault you created earlier.

2. Select Access policies, and then select Create to add a new policy.

3. Under Secret permissions, select the Get and List checkboxes.

4. Select Next. Paste the Client ID of the managed identity that you created earlier into the search bar, and then select the managed identity.

5. Select Next, and then select Next again.

6. Review the access policy details, and then select Create to apply the policy.

Create a service connection

1. Sign in to Azure DevOps, and then go to your project.

2. Select Project settings > Service connections > New service connection.

3. Select Azure Resource Manager, and then select Next.

4. For Identity Type, select Managed identity.

5. Under Step 1: Managed identity details, provide the following information:

   • Subscription for managed identity: Select the subscription that contains your managed identity.
   • Resource group for managed identity: Select the resource group that hosts your managed identity.
   • Managed identity: Select your managed identity from the dropdown list.

6. For Step 2: Azure Scope, provide the following information:

   • Scope level for service connection: Select Subscription.
   • Subscription for service connection: Select the subscription that the managed identity accesses.
   • Resource group for service connection: (Optional) Specify a resource group to limit the managed identity's access to one resource group.

7. For Step 3: Service connection details, provide the following information:

   • Service connection name: Enter a name for the service connection.
   • Service management reference: (Optional) Include context information from an ITSM database.
   • Description: (Optional) Enter a description.

8. Under Security, the Grant access permission to all pipelines option allows all pipelines to use this service connection. We don't recommend this option. Instead, authorize each pipeline individually to use the service connection.

9. Select Save to validate and create the service connection.

   

Set up key vault access policies

To access your key vault, you must first set up a service principal to grant access to Azure Pipelines.

1. Create a service principal.

2. Go to the Azure portal, and use the search bar to locate the key vault that you created earlier.

3. Select Access policies, and then select Create.

4. Under Secret permissions, add the Get and List permissions, and then select Next.

5. For Principal, paste the object ID of your service principal, select the service principal, and then select Next.

6. Select Next again, review the access policy, and then select Save.

Add role assignment

In the next step, you create an Azure Resource Manager service connection for your service principal. Before you verify the connection, you need to:

• Grant the service principal Reader access at the subscription level.
• Create a federated credential for your service principal.

To grant Reader access at the subscription level, follow these steps:

1. Go to the Azure portal, select Subscriptions, and then select your subscription.

2. Select Access control (IAM), and then select Add > Add role assignment.

3. On the Role tab, select Reader, and then select Next.

4. Select User, group, or service principal, and then choose Select members.

5. Paste the object ID of your service principal into the search bar, select it, and then choose Select.

6. Select Review + assign, review the settings, and then select Review + assign again to apply the role assignment.

Create a service connection

1. Sign in to Azure DevOps, and then go to your project.

2. Select Project settings > Service connections.

3. Select New service connection > Azure Resource Manager, and then select Next.

4. Select Service principal (manual), and then select Next.

5. For Identity Type, select App registration or managed identity (manual).

6. For Credential, select Workload identity federation.

7. Enter a name for the service connection, and then select Next.

8. For Environment, select Azure Cloud, and for Subscription scope, select Subscription.

9. Enter your Azure subscription ID and subscription name.

10. For Authentication, paste your service principal's application (client) ID and directory (tenant) ID.

11. Under Security, the Grant access permission to all pipelines option allows all pipelines to use this service connection. We don't recommend this option. Instead, authorize each pipeline individually to use the service connection.

12. Leave this window open. You return later to verify and save the service connection after you create the federated credential.

Create a service principal federated credential

1. Go to the Azure portal, enter the client ID of your service principal in the search bar, and then select your application.

2. Under Manage, select Certificates & secrets > Federated credentials.

3. Select Add credential, and then for Federated credential scenario, select Other issuer.

4. For Issuer, paste the Issuer value that you copied from the service connection.

5. For Subject identifier, paste the Subject identifier value that you copied from the service connection.

6. Enter a name for the federated credential, and then select Add.

7. Return to your service connection window, and select Verify and Save to save your service connection.

1. Sign in to Azure DevOps, and then go to your project.

2. Select Pipelines > New Pipeline.

3. Select Azure Repos Git (YAML), and then select your repository.

4. Select the Starter pipeline template.

5. The default pipeline includes sample echo commands. You don't need these commands, so you can remove them.

6. Add the Azure Key Vault task to your pipeline. Replace the placeholders with the name of the service connection that you created earlier and your key vault name. Your YAML file should look similar to the following example:

   trigger:
   - main
   
   pool:
     vmImage: ubuntu-latest
   
   steps:
   - task: AzureKeyVault@2
     displayName: Azure Key Vault
     inputs:
       azureSubscription: 'SERVICE_CONNECTION_NAME'
       KeyVaultName: 'KEY_VAULT_NAME'
       SecretsFilter: '*'
       RunAsPreJob: false
   

7. Add the following tasks to copy and publish the secret. This example is for demonstration purposes only. Don't use it in a production environment.

   trigger:
   - main
   
   pool:
     vmImage: ubuntu-latest
   
   steps:
   - task: AzureKeyVault@2
     displayName: Azure Key Vault
     inputs:
       azureSubscription: 'SERVICE_CONNECTION_NAME'
       KeyVaultName: 'KEY_VAULT_NAME'
       SecretsFilter: '*'
       RunAsPreJob: false
   
   - task: CmdLine@2
     displayName: Create file
     inputs:
       script: 'echo $(SECRET_NAME) > secret.txt'
   
   - task: CopyFiles@2
     displayName: Copy file
     inputs:
       Contents: secret.txt
       targetFolder: '$(Build.ArtifactStagingDirectory)'
   
   - task: PublishBuildArtifacts@1
     displayName: Publish Artifact
     inputs:
       PathtoPublish: '$(Build.ArtifactStagingDirectory)'
       ArtifactName: 'drop'
       publishLocation: 'Container'
   

8. Select Save and run, and then select it once more to commit your changes and trigger the pipeline. If prompted, select Allow to grant the pipeline access to Azure resources.

9. After the pipeline starts, select the CmdLine task to view the logs.

   

10. When the pipeline run finishes, return to the pipeline summary and select the published artifact.

    

11. Select drop > secret.txt to download the file.

    

12. Open the downloaded text file. It should contain the secret retrieved from your key vault.

1. Sign in to Azure DevOps, and then go to your project.

2. Select Pipelines, and then select New Pipeline.

3. Select Use the classic editor to create a classic pipeline.

4. Select Azure Repos Git, select your repository and default branch, and then select Continue.

5. Select the .Net Desktop pipeline template.

6. For this example, only the last two tasks are required. Hold Ctrl and then select the first five tasks. Right-click, and then select Remove selected tasks(s) to delete them.

   

7. Select + to add a new task. Search for the Command line task, select it, and then select Add. Configure the task:

   • Display name: Enter Create file.
   • Script: Enter echo $(SECRET_NAME) > secret.txt.

   

8. Select + to add a new task. Search for the Azure Key Vault task, select it, and then select Add. Configure the task:

   • Display name: Enter Azure Key Vault.
   • Azure subscription: Select the service connection that you created earlier.
   • Key vault: Select your key vault.
   • Secrets filter: Enter a comma‑separated list of secret names, or use an asterisk (*) to download all secrets.

   

9. Select the Copy files task, and configure the following fields:

   • Display name: Enter Copy File.
   • Contents: Enter secret.txt.
   • Target Folder: Enter $(build.artifactstagingdirectory).

   

10. Select the Publish Artifacts task, and configure the following fields:

    • Display name: Enter Publish Artifact.
    • Path to publish: Enter $(build.artifactstagingdirectory).
    • Artifact name: Enter drop.
    • Artifact publish location: Enter Azure Pipelines.

    

11. Select Save and queue, and then select Run to start the pipeline.

12. After the pipeline finishes, return to the pipeline summary and select the published artifact.

13. Select drop > secret.txt to download the artifact.

    

14. Open the downloaded text file. It should contain the secret that was retrieved from your key vault.