What is Azure Key Vault and how should secrets be handled in a cloud application?

Azure Key Vault is a managed service for storing secrets, keys, and certificates, backed by hardware security modules on the Premium tier. It gives you centralised storage, access control through RBAC or access policies, full audit logging of every access, versioning, and expiry.

The three object types: secrets (connection strings, API keys, passwords), keys (cryptographic keys for encryption and signing, which can be used without ever being exported), and certificates (TLS certificates, with automatic renewal from integrated authorities).

How secrets should be handled — the priority order:

• Best: have no secret at all. Use a managed identity so your App Service or VM authenticates to SQL, Storage, or Key Vault itself with no credential stored anywhere. This eliminates the entire class of problem and is the answer interviewers are listening for.
• Where a secret is unavoidable — a third-party API key — store it in Key Vault and retrieve it at runtime using a managed identity. Never in code, configuration files, environment variables committed to a repository, or a container image.
• Rotate on a schedule, and make sure the application handles rotation without a restart. Event Grid can notify you on expiry.
• Least privilege — an application needs Get on the specific secrets it uses, not List on the whole vault.
• Enable soft delete and purge protection so a deleted vault or secret is recoverable.