This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Implement CI/CD by using SQL Database Projects
      --> Implement secrets management

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern database applications rarely operate in isolation. They connect to databases, Azure services, AI models, storage accounts, APIs, messaging services, and monitoring tools. Each connection typically requires credentials such as passwords, connection strings, API keys, certificates, tokens, or managed identities.

One of the most common security mistakes is storing these secrets directly in application code, SQL scripts, configuration files, or source control repositories. Modern DevOps practices eliminate this risk by implementing centralized secrets management, ensuring that sensitive information is securely stored, rotated, audited, and accessed only by authorized applications and users.

For the DP-800: Developing AI-Enabled Database Solutions certification exam, candidates should understand how secrets management integrates with SQL Database Projects, Azure DevOps, GitHub, Azure Key Vault, Managed Identity, Microsoft Entra ID, CI/CD pipelines, and Azure SQL Database deployments.

What Are Secrets?

A secret is any sensitive information used to authenticate or authorize access to a resource.

Examples include:

• Database passwords
• SQL authentication credentials
• Azure Storage account keys
• Azure OpenAI API keys
• Azure AI Search API keys
• Connection strings
• Service Principal secrets
• OAuth client secrets
• Certificates
• Personal Access Tokens (PATs)
• SAS tokens
• Encryption keys

Secrets should always be protected because unauthorized disclosure can compromise systems and data.

Why Secrets Management Is Important

Poor secrets management can result in:

• Unauthorized database access
• Data breaches
• Credential theft
• Service impersonation
• Compliance violations
• Accidental exposure in public repositories
• Unauthorized AI model usage
• Financial loss

Proper secrets management helps organizations achieve:

• Least privilege
• Secure authentication
• Regulatory compliance
• Credential rotation
• Centralized auditing
• Simplified administration

Common Security Risks

Common mistakes include storing secrets in:

{
    "ConnectionString":
    "Server=myserver;
    User ID=admin;
    Password=P@ssword123!"
}

or

CREATE LOGIN appuser
WITH PASSWORD='MyPassword!';

or

AzureOpenAIKey=abc123xyz

These files often become part of Git repositories and remain permanently visible in version history, even if later deleted.

Principles of Secrets Management

Microsoft recommends the following principles:

• Never hard-code secrets.
• Never store secrets in source control.
• Use centralized secret stores.
• Use managed identities whenever possible.
• Rotate secrets regularly.
• Grant only required permissions.
• Audit secret access.
• Automate secret retrieval.
• Encrypt secrets both at rest and in transit.

Azure Key Vault

Azure Key Vault is Microsoft’s centralized secrets management service.

It securely stores:

• Passwords
• Keys
• Certificates
• Tokens
• Connection strings
• API keys

Applications retrieve secrets at runtime rather than storing them locally.

Benefits include:

• Centralized management
• Encryption
• Access policies
• Role-Based Access Control (RBAC)
• Secret versioning
• Automatic rotation support
• Auditing
• High availability

Types of Objects in Azure Key Vault

Azure Key Vault stores three object types:

Secrets

Examples:

• Passwords
• API keys
• Connection strings

Keys

Used for:

• Encryption
• Digital signatures
• Key management

Certificates

Used for:

• TLS authentication
• Client authentication
• Secure communications

Secret Lifecycle

Typical lifecycle:

Create Secret
↓
Store in Key Vault
↓
Grant Access
↓
Retrieve During Execution
↓
Rotate
↓
Update Applications
↓
Retire Old Version

Secret Versioning

Azure Key Vault automatically versions secrets.

Example:

DatabasePassword
Version 1
↓
Version 2
↓
Version 3

Applications can:

• Use the latest version
• Pin to a specific version
• Rotate without downtime

Managed Identity

Whenever possible, Microsoft recommends using Managed Identity instead of secrets.

Managed Identity eliminates:

• Passwords
• Client secrets
• Credential rotation

Instead:

Azure automatically authenticates the workload.

Supported services include:

• Azure SQL Database
• Azure App Service
• Azure Functions
• Azure Container Apps
• Azure Kubernetes Service
• Azure Virtual Machines
• Azure Data Factory
• Microsoft Fabric services (where supported)

Types of Managed Identity

System-Assigned Managed Identity

Characteristics:

• One identity
• Lifecycle tied to the Azure resource
• Automatically deleted with the resource

User-Assigned Managed Identity

Characteristics:

• Independent Azure resource
• Shared across multiple services
• Longer lifecycle
• Easier identity reuse

Microsoft Entra ID Authentication

Microsoft recommends using Microsoft Entra ID authentication rather than SQL logins whenever possible.

Benefits include:

• Centralized identity management
• Multi-factor authentication
• Conditional Access
• Passwordless authentication
• Single Sign-On
• Managed Identity integration

Secrets in SQL Database Projects

SQL Database Projects should never contain:

• Passwords
• API keys
• Tokens
• Production connection strings

Instead they should contain:

• Schema definitions
• Stored procedures
• Functions
• Views
• Security objects
• Build configurations

Secrets should be injected during deployment.

Secrets in Azure DevOps

Azure DevOps supports secure secret storage through:

• Variable Groups
• Secret Variables
• Azure Key Vault integration
• Service Connections
• Managed Identity (supported services)

Example pipeline:

Build
↓
Retrieve Secret
↓
Deploy DACPAC
↓
Remove Secret From Memory

Secrets remain encrypted throughout execution.

Secrets in GitHub

GitHub provides encrypted GitHub Secrets.

Secrets can be defined at:

• Repository level
• Environment level
• Organization level

Examples:

• SQL_PASSWORD
• AZURE_CLIENT_ID
• OPENAI_API_KEY

GitHub Actions retrieves them securely during workflow execution.

GitHub Actions Example

env:
  SQL_PASSWORD: ${{ secrets.SQL_PASSWORD }}

The actual password never appears in the workflow file.

Azure DevOps Example

variables:
- group: ProductionSecrets

The pipeline references the secure variable group rather than storing credentials.

Secret Rotation

Secrets should be rotated periodically.

Reasons include:

• Compliance
• Reduced exposure
• Personnel changes
• Compromised credentials
• Security policies

Rotation process:

Create New Secret
↓
Update Applications
↓
Validate
↓
Disable Old Secret
↓
Delete Old Secret

Access Control

Access should follow the Principle of Least Privilege.

Applications receive:

• Only required permissions
• Only required secrets
• Only for required duration

Avoid granting:

• Vault Administrator
• Owner
• Full secret access

Unless absolutely necessary.

RBAC vs Access Policies

Azure Key Vault supports:

Azure RBAC

Uses Azure role assignments.

Examples:

• Key Vault Secrets User
• Key Vault Administrator
• Key Vault Reader

Recommended for new deployments.

Access Policies

Older permission model.

Still supported but Microsoft recommends RBAC for most new implementations.

Secret Auditing

Organizations should monitor:

• Secret retrieval
• Failed access attempts
• Secret updates
• Secret deletion
• Permission changes

Azure Monitor and Azure Activity Logs provide auditing capabilities.

CI/CD Pipeline Integration

Typical deployment:

Developer
↓
GitHub
↓
Pull Request
↓
Build
↓
Retrieve Secrets
↓
Deploy DACPAC
↓
Azure SQL Database

Secrets remain outside source control throughout the deployment.

Environment-Specific Secrets

Different environments use different secrets.

Example:

Each environment references its own Key Vault or secret store.

Secure Connection Strings

Instead of:

Server=myserver;
User=admin;
Password=P@ssword123

Use:

• Managed Identity
• Microsoft Entra authentication
• Secret references
• Azure Key Vault retrieval

Preventing Secret Leakage

Organizations should:

• Enable secret scanning
• Use repository scanning
• Review pull requests
• Block committed secrets
• Rotate exposed credentials immediately
• Monitor repositories continuously

GitHub Advanced Security and Microsoft Defender for DevOps can detect exposed credentials.

Common Mistakes

Avoid:

• Hard-coded passwords
• SQL logins embedded in code
• API keys inside scripts
• Secrets in Git repositories
• Emailing passwords
• Sharing credentials among developers
• Using production secrets in development
• Long-lived credentials
• Ignoring secret rotation

Best Practices

Microsoft recommends:

• Use Azure Key Vault.
• Prefer Managed Identity over passwords.
• Use Microsoft Entra authentication.
• Never commit secrets to Git.
• Rotate secrets regularly.
• Enable auditing.
• Apply least privilege.
• Separate secrets by environment.
• Automate secret retrieval.
• Protect CI/CD pipelines.
• Use RBAC for Key Vault authorization.
• Monitor secret access continuously.

DP-800 Exam Tips

Remember these important points:

• Azure Key Vault is Microsoft’s preferred centralized secrets management solution.
• Managed Identity is preferred over passwords or client secrets whenever supported.
• SQL Database Projects should never contain secrets.
• GitHub Secrets and Azure DevOps Secret Variables securely provide credentials during pipeline execution.
• Secrets should be retrieved at runtime rather than stored in source code.
• Secret rotation reduces the risk of credential compromise.
• Microsoft Entra ID provides modern authentication with support for passwordless and managed identities.
• Apply least privilege to secret access.
• Enable auditing and monitoring for secret usage.
• Never commit connection strings containing passwords to source control.

Practice Exam Questions

Question 1

A development team wants to eliminate database passwords from its Azure-hosted application. Which authentication method should be used whenever possible?

A. SQL Authentication with a strong password

B. Windows Authentication over VPN

C. Managed Identity

D. Shared administrator account

Answer: C

Explanation: Managed Identity allows Azure resources to authenticate to supported services without storing passwords or client secrets, reducing administrative overhead and improving security.

Question 2

Which Azure service is specifically designed to centrally store passwords, certificates, keys, and connection strings?

A. Azure Key Vault

B. Azure Monitor

C. Azure Storage

D. Azure Policy

Answer: A

Explanation: Azure Key Vault provides secure storage, versioning, access control, auditing, and rotation capabilities for secrets, keys, and certificates.

Question 3

A SQL Database Project needs to connect to an Azure SQL Database during deployment. Where should the production connection string password be stored?

A. In Azure Key Vault or a secure pipeline secret store

B. In a README file

C. In the SQL project file

D. In the source code comments

Answer: A

Explanation: Production credentials should never be committed to source control. They should be stored securely in Azure Key Vault or pipeline secret stores such as GitHub Secrets or Azure DevOps Secret Variables.

Question 4

Which practice represents the greatest security risk?

A. Using Microsoft Entra ID authentication

B. Storing passwords in Azure Key Vault

C. Using Managed Identity

D. Hard-coding API keys in application source code

Answer: D

Explanation: Hard-coded secrets are easily exposed through source control, backups, or application binaries and are considered a major security vulnerability.

Question 5

Why should secrets be rotated on a regular basis?

A. To reduce the risk associated with compromised credentials

B. To improve SQL query performance

C. To reduce storage costs

D. To simplify branching strategies

Answer: A

Explanation: Regular rotation limits the usefulness of compromised credentials and helps organizations meet compliance and security requirements.

Question 6

Which GitHub feature securely provides sensitive values to GitHub Actions workflows?

A. Repository Wiki

B. GitHub Issues

C. GitHub Releases

D. GitHub Secrets

Answer: D

Explanation: GitHub Secrets securely stores encrypted values that workflows can access during execution without exposing them in source code.

Question 7

A company wants applications to authenticate to Azure SQL Database using centralized identity management, Multi-Factor Authentication, and Conditional Access policies. Which authentication method best supports these requirements?

A. SQL logins

B. Microsoft Entra ID authentication

C. Shared local accounts

D. Anonymous authentication

Answer: B

Explanation: Microsoft Entra ID provides centralized authentication with advanced security features including MFA, Conditional Access, Single Sign-On, and integration with Managed Identity.

Question 8

Which authorization principle should be applied when granting applications access to secrets?

A. Full administrative access

B. Read and write access for all developers

C. Principle of Least Privilege

D. Anonymous access

Answer: C

Explanation: Applications should receive only the permissions required to perform their tasks, reducing the potential impact of compromised identities.

Question 9

What is the primary benefit of storing secrets outside a SQL Database Project?

A. Faster database indexing

B. Reduced network latency

C. Automatic SQL optimization

D. Sensitive credentials remain protected and can be managed independently of application code

Answer: D

Explanation: Separating secrets from application code improves security, supports credential rotation, simplifies compliance, and prevents accidental exposure through source control.

Question 10

A CI/CD pipeline retrieves a database password from Azure Key Vault immediately before deploying a DACPAC. What is the primary advantage of this approach?

A. It permanently stores the password inside the DACPAC.

B. It eliminates the need for authentication.

C. It allows credentials to be securely retrieved at deployment time without storing them in source control.

D. It improves query execution plans.

Answer: C

Explanation: Retrieving secrets during deployment keeps credentials out of source control and build artifacts while allowing secure, centralized management and rotation of sensitive information.

Go to the DP-800 Exam Prep Hub main page