An app running on Azure (a VM or AKS pod) needs to read a database password from Key Vault with no stored credentials. How do you set it up?
What they are really testing: Whether you can wire identity end to end: assign a managed identity, grant it a scoped Key Vault role, and have the app fetch the secret at runtime. The practical no-secret pattern, including the AKS workload-identity nuance.
A real interview question
An app running on Azure (a VM or AKS pod) needs to read a database password from Key Vault with no stored credentials. How do you set it up?
What most people say
drag me
“I would store the Key Vault access key as an environment variable so the app can read the secret.”
An access key in an env var is exactly the stored credential the question rules out, it just relocates the secret. The right pattern is a managed identity authenticating to Key Vault with no stored credential at all.
The follow-ups they ask next
How does an AKS pod authenticate to Key Vault without a stored secret?
Workload identity: the pod Kubernetes service account is federated to an Entra identity, so the pod receives short-lived tokens via the federated credential, no secret mounted. Grant that identity the Key Vault role.
How do you handle the database password rotating?
Rotate it in Key Vault; the app reads the current version at refresh time (cache with a TTL or use a versionless reference). Managed identity access means no app credential changes are needed.
What the interviewer is listening for
- Managed identity / AKS workload identity, no stored cred
- Scoped Key Vault Secrets User role
- Runtime fetch via DefaultAzureCredential + rotation/caching
What sinks the answer
- Stores a Key Vault key/secret in env or config
- Broad access instead of scoped role
- No notion of workload identity for AKS
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“No stored credential, wire identity end to end: [give the workload a managed identity (VM MI, or AKS workload identity federating the service account)], [grant it Key Vault Secrets User scoped to that vault], [the app authenticates with the managed identity (DefaultAzureCredential) and reads the secret at runtime, nothing in env/config], and [cache/refresh + rotate the secret in Key Vault + use audit logs].”
Keep going with azure
Foundation
What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
Foundation
In Azure, what handles authentication versus authorization?
Foundation
Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
Junior
How does Azure RBAC work? Explain roles, scopes, and assignments.
Junior
What happens when a user signs in to an Azure/Entra-protected application?
Junior
What is the difference between a service principal and a managed identity, and why prefer managed identities?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free