Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
In this tutorial, you learn how to easily add everything you need to start using Azure Key Vault to manage your secrets for web projects in Visual Studio, whether you're using ASP.NET Core or any type of ASP.NET project. By using the Connected Services feature in Visual Studio, you can have Visual Studio automatically add all the NuGet packages and configuration settings you need to connect to Key Vault in Azure.
Prerequisites
- An Azure account. If you don't have an Azure account, activate your Azure benefits for Visual Studio subscribers or sign up for a free trial.
- Visual Studio 2019 version 16.3 or later Download it now.
Add Key Vault support to your project
Now, connection to Key Vault is established and you can access your secrets in code. If you just created a new key vault, test it by creating a secret that you can reference in code. You can create a secret by using the Azure portal, PowerShell, or the Azure CLI.
See code examples of working with secrets at Azure Key Vault Secrets client library for .NET - Code examples.
Configure access to the key vault
If you followed this tutorial with Visual Studio 2022 version 17.11 or earlier, your Key Vault permissions are set up to run with your own Azure subscription, but that might not be desirable for a production scenario. You can create a managed identity to manage Key Vault access for your app. See How to Authenticate to Key Vault and Assign a Key Vault access policy.
If your key vault is running on a different Microsoft account than the one you're signed in to Visual Studio (for example, the key vault is running on your work account, but Visual Studio is using your private account) you get an error in your Program.cs file, that Visual Studio can't get access to the key vault. To fix this issue, go to the Azure portal, open your key vault, and choose Access control (IAM) to set permissions. See Provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control (RBAC).
Note
Older key vaults might use a legacy access policy model. It's recommended to migrate older key vaults to use Azure RBAC. See Azure role-based access control (RBAC) vs. access policies.
Next steps
Learn more about Key Vault development by reading the Key Vault Developer's Guide.
If your goal is to store configuration for an ASP.NET Core app in an Azure Key Vault, see Azure Key Vault configuration provider in ASP.NET Core.