Skip to content
datastudyguides

AI-200 · 4.1.1 · Secure, monitor, and troubleshoot Azure solutions

Key Vault rotation

Secure secrets by using Azure Key Vault, including rotation and retrieval

Use to read secrets, then rotate them by creating new versions from expiry-driven automation.

Read secrets without stored credentials

Azure Key Vault flow for retrieving a secret with managed identity and rotating a secret through a near-expiry event, Event Grid, an Azure Function, and a new secret version.

Store secrets in and let the application authenticate with a . The identity still needs the right data-plane role. DefaultAzureCredential makes the same code work with a developer sign-in locally and managed identity in Azure.

Rotate by creating a new version

A secret value does not rotate itself. A near-expiry event can trigger automation that creates a new secret version and updates the dependent system.

client.set_secret("db-password", new_password)

Readers that request the latest version pick up the replacement on their next fetch. A can cache its value, so use the platform refresh mechanism or a configuration change when the application must see the new version sooner.

Key points

  • SecretClient: built from vault URL and credential; `get_secret` returns latest version
  • : your `az login` on a laptop, a in Azure
  • Roles: Secrets User reads values, Reader sees metadata, Secrets Officer changes secrets
  • : `@Microsoft.KeyVault(SecretUri=...)` as an value

Click an underlined term for a one-line explanation, or see them all in the glossary .

Exam trap

A caches its value, refreshing about every 24 hours; a configuration change or refresh call picks up a new version sooner.

Sources · 4 Microsoft Learn pages Show ▾

Checked on October 4, 2026. Report a problem

Go deeper on Microsoft Learn

Checked against Microsoft Learn on October 4, 2026. Report a problem with this card

How well do you know this?