What's changed: Added per-section figures (cert-figure-retrofit). New AI-200 Chapter 4 (secret management = Key Vault/App Configuration/managed identity keyless/RBAC, observability = OpenTelemetry instrumentation/distributed tracing/Application Insights·Azure Monitor/KQL/AI-specific monitoring = tokens·cost·quota·generation quality)
4.1Secret Management and Identity
Understand securing an AI back-end’s secrets and configuration—Azure Key Vault (secrets/keys/certificates), Azure App Configuration (settings and feature flags), and keyless auth via managed identity with RBAC—from a developer’s view.
An AI back-end handles secrets—AI-service connection info, database credentials, API keys. The rule is to never hard-code them in code or config files. On Azure, centralize secrets, keys, and certificates in Azure Key Vault, and have the app retrieve them keylessly via managed identity. Manage configuration values (endpoints, parameters) and feature flags centrally in Azure App Configuration for safe per-environment swaps and gradual feature rollout.
| Purpose | Service |
|---|---|
| Centralize secrets, keys, certificates | Azure Key Vault |
| Centralize settings and feature flags | Azure App Configuration |
| Authenticate without secrets | Managed identity (keyless) |
| Least-privilege access control | RBAC |
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.