What are safer alternatives to storing an Azure app client secret?
Asked by
MellowCedar47
I'm new to Azure and have a resource that is accessed by a web app in another Azure tenant. The web app currently authenticates with a service principal, which requires embedding the client ID, tenant ID, and client secret in its script. Storing the secret in a Key Vault doesn't seem to solve the problem because the app would still need credentials to access the vault. Would using a separate service principal for Key Vault access work, or is there a better secretless authentication approach?
Answers
Workload identity federation is usually the best option here. It lets the external application authenticate through a trusted token provider without storing a client secret, so there’s no secret to expose or rotate. The exact setup depends on the web app’s identity provider and deployment environment.
Reply to this answer
Certificate-based authentication is another option. The app registration stores only the public certificate, while the consuming application keeps the private key in a protected certificate store or managed secret system. If the workload runs in Azure, a system-assigned managed identity can also be granted access to Key Vault, avoiding hardcoded credentials entirely.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar47: That sounds safer than putting another service principal secret in the application. I’ll look into whether the web app’s identity provider supports federation.