I am coming from AWS / Linux and try this in Azure / Windows, now.

The Question:

I have a windows container in Azure and want it to get some secrets from an Azure Vault. How can I do that?

This is how I thought it would work (but didn't):

I had expected that I could just run

az keyvault secret show --name "my_secret" --vault-name "my_fault"

... at least after adding permissions to the container. Unfortunately, I cannot find out how to add permissions to the container to access the vault.

What I have tried so far:

I have created the vault and added an "application" under "Access Policies". I do not find any way how to make the container act as the "application".

I have read that items need to get an "identity assigned" 1, but this seems to be not supported with windows containers 2. I had tried it out before I found the documentation, and it did not work.

How can I access the azure key vault from an azure container?

  • What are you trying to run on the container or is it just a plain container with no apps as such and you're running the az commands from say PowerShell within the container?
    – Simon
    Jan 14, 2020 at 22:15
  • My plan was, to run test scripts within the container(s). Commands will be run via PowerShell; I will probably launch a ps script automatically after a container is launched.
    – hey
    Jan 14, 2020 at 22:33

1 Answer 1


Assuming this is transient container then my suggestion to work around the not yet implemented issues would be that whatever creates it does so by passing in secure environment variables for the values you want from the key vault; then your scripts can access the data that way.

I'm not sure what your security considerations are so you'll need to take that into account so people can't login to the container to view the environment variables.

As an example I have a function that uses the .Net Fluent API to create a container group and then sets the environment variables for the container using ".WithEnvironmentVariablesWithSecuredValue()" this means anyone whose looking at the container in the portal won't be able to see the values in plain text.

Then you assign a managed identity to the function and then give that identity get permissions to secrets in the key vault and then you can either access the key vault in code in the function or the easier option is the put them as app settings for your function and then just get them as environment variables in your function - https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references

Hope this helps or gives you an idea on a workaround?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.