Instiq
Chapter 4 · Develop a Security and Compliance Plan·v2.0.0·Updated 6/3/2026·~10 min

What's changed: Deepened AZ-400 Chapter 4 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)

4.2Managing Secrets and Credentials

Key points

Understand handling secrets safely—Key Vault, variable groups/secret variables, managed identity/workload identity federation, secret scanning, and least privilege. Prevent credential leakage.

The biggest risk is credential leakage. Centralize secrets in Key Vault and go keyless (federation/managed identity) when possible.

4.2.1Secret management

Diagram of secret management: centralize secrets in Azure Key Vault; from pipelines, inject them only at runtime via variable groups (linked to Key Vault) or secret variables, never logging them; make connections to external resources keyless via workload identity federation or managed identity to eliminate long-lived keys; detect committed secrets via secret scanning (push protection); and grant least-privilege access—DevSecOps secret management.
Managing secrets and credentials
  • Key Vault: centralize secrets, passed to pipelines safely via variable group links.
  • Secret variables: injected only at runtime, never logged (masked).
  • Keyless: eliminate long-lived keys with workload identity federation/managed identity.
  • Secret scanning: detect committed secrets (push protection blocks the push); enforce least privilege.
Exam point

Common on AZ-400: centralize secrets = Key Vault, inject only at runtime = secret variables (not logged), keyless = workload identity federation/managed identity, leak detection = secret scanning/push protection. A leaked credential must be rotated, not just removed from history.

Continue reading — free sign-up

You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.

Get started freeLog in