---
title: "Managing Secrets and Secure Access in Azure Applications"
description: "Example of managing the secrets and permissions via services and features like KeyVault, AD Managed Identity, AD RBAC"
url: "https://www.pulumi.com/dev/examples/classic-azure-ts-msi-keyvault-rbac/"
image: "https://www.pulumi.com/assets/og/dev/examples/classic-azure-ts-msi-keyvault-rbac.png"
---

# Managing Secrets and Secure Access in Azure Applications

Example of managing the secrets and permissions via services and features like KeyVault, AD Managed Identity, AD RBAC

- Source on GitHub: https://github.com/pulumi/examples/tree/master/classic-azure-ts-msi-keyvault-rbac
- Deploy with Pulumi: https://app.pulumi.com/new?template=https%3A%2F%2Fgithub.com%2Fpulumi%2Fexamples%2Ftree%2Fmaster%2Fclassic-azure-ts-msi-keyvault-rbac

## Get started with this example

This example lives in the [pulumi/examples](https://github.com/pulumi/examples/tree/master/classic-azure-ts-msi-keyvault-rbac) repo. Pull down just this directory to follow along:

```bash
git clone --filter=blob:none --sparse https://github.com/pulumi/examples pulumi-examples
git -C pulumi-examples sparse-checkout set classic-azure-ts-msi-keyvault-rbac
cd pulumi-examples/classic-azure-ts-msi-keyvault-rbac
```

[Managed identities](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/) for Azure resources provides Azure services with an automatically managed identity in Azure Active Directory (Azure AD).

This example demonstrates using a managed identity with Azure App Service to access Azure KeyVault, Azure Storage, and Azure SQL Database without passwords or secrets.

The application consists of several parts:

- An ASP.NET Application which reads data from a SQL Database and from a file in Blob Storage
- App Service which host the application. The application binaries are placed in Blob Storage, with Blob Url placed as a secret in Azure Key Vault
- App Service has a Managed Identity enabled
- The identify is granted access to the SQL Server, Blob Storage, and Key Vault
- No secret information is placed in App Service configuration: all access rights are derived from Active Directory

## Running the App

1. Create a new stack:

    ```bash
    pulumi stack init dev
    ```

1. Login to Azure CLI (you will be prompted to do this during deployment if you forget this step):

    ```bash
    az login
    ```

1. Restore NPM dependencies:

    ```bash
    npm install
    ```

1. Build and publish the ASP.NET Core project:

    ```bash
    dotnet publish webapp
    ```

1. Configure target Azure environment:

    ```bash
    pulumi config set azure:location <location>
    pulumi config set azure:subscriptionId <YOUR_SUBSCRIPTION_ID>
    ```

1. Run `pulumi up` to preview and deploy changes:

    ```console
    $ pulumi up
    Previewing changes:
    ...

    Performing changes:
    ...
    info: 15 changes performed:
        + 15 resources created
    Update duration: 4m16s
    ```

1. Check the deployed website endpoint:

    ```console
    $ pulumi stack output endpoint
    https://app129968b8.azurewebsites.net/
    $ curl "$(pulumi stack output endpoint)"
    Hello 311378b3-16b7-4889-a8d7-2eb77478beba@50f73f6a-e8e3-46b6-969c-bf026712a650! Here is your...
    ```