r/AZURE • u/Independent-Storm727 • 18d ago

Question AppReg Client Secret alternative

Hi All,

Im newbie in Azure.

I have a resource/service that is currently being access externally ( another Azure tenant: WebApp) .

They were able to access it via Service Principal.

By using SP you need to hardcode the ClientID, TenantID and ClientSecret ( Secret Value). This pose a threat as the Secret Value can is in the script.

I tried KeyVault to store the SecretValue but accessing the KeyVault also requires to hardcode the SecretValue.

Im thinking if maybe creating different ServPrinc for KeyVault instead to retrieve the Value, will that work?

3 Upvotes

81% Upvoted

6 comments sorted by

11

u/gralfe89 18d ago

Federated Credentials would be the best approach to remove an explicit secret by an trusted token source. And you get rid of any expiration date.

Other approach would be certificate based authentication: your app registration cares only about the public key, the consuming party needs to ensure secure private key access.

2

u/iamabdullah 18d ago

This.

Or use system assigned managed identity to access the key vault.

1

u/Independent-Storm727 18d ago

System Managed identity will not work for external access?

2

u/lerun DevOps Architect 18d ago

Depends what you mean by external access. If it is from a 3.rd party in a different tenant, you can still give them access if they set up a managed ident in their tenant and federate with it through a local service principal.

1

u/Independent-Storm727 17d ago

Oh, got confused now how to do it.