This post is a part of the AI-200: Developing AI Cloud Solutions on Azure  Exam Prep Hub.
This topic falls under these sections:
Secure, monitor, and troubleshoot Azure solutions (20–25%)
   --> Implement secure Azure solutions
      --> Store and retrieve app configuration information by using Azure App Configuration

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Azure applications frequently need configuration values such as database endpoints, service URLs, application settings, feature flags, and environment-specific options. Keeping these values directly inside application code or configuration files can make applications harder to maintain, deploy, and operate.

Azure App Configuration is a managed Azure service that provides a centralized place to store and manage application configuration settings and feature flags. Applications can retrieve these settings at runtime, and supported application frameworks can refresh configuration dynamically without requiring an application restart.

For the AI-200: Developing AI Cloud Solutions on Azure exam, you should understand how to:

• Create and manage an App Configuration store
• Store configuration as key-value pairs
• Organize configuration using key prefixes and labels
• Retrieve configuration from applications
• Use feature flags
• Secure access to App Configuration
• Use managed identities
• Combine App Configuration with Azure Key Vault
• Refresh configuration dynamically
• Understand configuration precedence and environment-specific settings

1. What Is Azure App Configuration?

Azure App Configuration is a centralized configuration service designed to separate application configuration from application code.

Instead of embedding settings such as:

DatabaseEndpoint = "https://production-database..."
ModelEndpoint = "https://ai-service..."
MaxTokens = 1000
EnableNewSearch = true

directly into an application, those settings can be stored in an App Configuration store.

The application retrieves the settings when it starts and, when dynamic configuration is enabled, can retrieve updated values while it is running.

This is particularly useful for distributed applications containing:

• Azure Functions
• Container Apps
• App Service applications
• AKS applications
• Microservices
• AI services
• Background workers
• APIs

Centralizing configuration reduces the need to modify and redeploy application code simply because an operational setting changed.

2. Why Use Azure App Configuration?

Consider an AI application containing several services:

                 Azure App Configuration
                         |
          +--------------+--------------+
          |              |              |
       API Service    AI Worker      Web App
          |              |              |
       Settings       Settings       Settings

Without centralized configuration, each application might have its own configuration files.

This can create problems such as:

• Different applications using inconsistent settings
• Configuration duplicated across services
• Settings requiring application redeployment
• Difficult environment management
• Increased operational complexity
• Configuration changes that are difficult to track

App Configuration provides a centralized configuration layer.

Important distinction

Azure App Configuration is not intended to replace Azure Key Vault for secrets.

A good general pattern is:

Azure App Configuration → application settings and feature flags
Azure Key Vault → secrets

App Configuration can contain references to secrets stored in Key Vault, allowing the application configuration and secret management concerns to work together.

3. Key-Value Pairs

The fundamental storage mechanism in App Configuration is the key-value pair.

For example:

The key identifies the setting, while the value contains the configuration data.

App Configuration treats keys as strings. It does not interpret hierarchical delimiters itself. Developers commonly use characters such as : or / to create logical namespaces.

For example:

AI:Model
AI:Temperature
AI:MaxTokens
Database:Endpoint
Database:Timeout
Logging:Level
Logging:EnableDiagnostics

This makes configuration easier to organize and query.

4. Keys Are Case-Sensitive

App Configuration keys are case-sensitive.

For example:

App:Name

and:

app:name

are distinct keys.

However, relying on capitalization alone to distinguish settings is generally discouraged because application frameworks may handle configuration keys differently.

Exam tip

Remember:

App Configuration keys are case-sensitive.

5. Labels

One of the most important App Configuration concepts for AI-200 is the label.

A label allows different values to be associated with the same key.

For example:

Key: AI:Model

could have:

This allows an application to use different configuration values depending on its environment.

Why labels are useful

Labels are commonly used for:

• Development
• Testing
• Staging
• Production
• Application versions
• Regional configurations
• Deployment rings

For example:

AI:Temperature

could be:

Development → 0.8
Production  → 0.2

The application doesn’t need a different key name for every environment.

6. Unlabeled Configuration

A key-value can also have no label.

For example:

AI:Model
Label: Production
Value: production-model

and:

AI:Temperature
Label: Production
Value: 0.2

An unlabeled value can act as a common/default configuration.

A useful pattern is:

No label       → default
Development    → development override
Test           → test override
Production     → production override

If an environment-specific value doesn’t exist, the application can use the unlabeled value as the fallback, depending on how configuration is loaded.

7. Configuration Namespaces

A hierarchical naming convention makes large configuration stores much easier to manage.

For example:

AI:Model
AI:Endpoint
AI:Temperature
AI:MaxTokens
Database:Server
Database:DatabaseName
Database:Timeout
Storage:Account
Storage:Container
Logging:Level
Logging:EnableDiagnostics

A developer can then retrieve groups of settings using key filters.

For example:

AI:*

can represent all keys beginning with:

AI:

This is especially useful when multiple services share an App Configuration store.

8. Retrieving Configuration

Applications can retrieve configuration from App Configuration using client libraries appropriate to their language and framework.

Supported integrations include:

• .NET
• ASP.NET Core
• Java/Spring
• JavaScript/Node.js
• Python
• Go
• REST API

The application establishes access to the App Configuration store and loads the required key-values.

A conceptual flow is:

Application starts
       |
       v
Authenticate to App Configuration
       |
       v
Select configuration keys
       |
       v
Load key-value pairs
       |
       v
Application uses settings

The application doesn’t need to know where each individual configuration value is physically stored.

9. Authentication and Secure Access

Applications need permission to access an App Configuration store.

A production application should generally use Microsoft Entra ID authentication and managed identities rather than embedding credentials or connection strings in source code.

For example:

Azure Function
     |
     | Managed Identity
     v
Azure App Configuration

The managed identity can be granted appropriate permissions to read configuration.

This avoids putting long-lived credentials in application code.

Why this matters for AI-200

When you see a scenario asking for:

“The most secure way for an Azure-hosted application to access App Configuration without storing credentials in code”

the likely answer involves:

Managed identity + appropriate Azure RBAC permissions.

10. App Configuration and Azure Key Vault

These two services are complementary rather than interchangeable.

Azure App Configuration

Use it primarily for:

• Application settings
• Feature flags
• Environment-specific configuration
• Non-secret configuration
• Centralized configuration

Azure Key Vault

Use it for:

• Passwords
• API keys
• Connection secrets
• Certificates
• Other sensitive secrets

A common architecture is:

                 Application
                      |
             Managed Identity
                      |
          +-----------+-----------+
          |                       |
          v                       v
 Azure App Configuration      Azure Key Vault
          |                       |
   App settings              Secrets
   Feature flags
          |
          +---- Key Vault references

App Configuration can store a Key Vault reference, allowing the application to retrieve a secret through the reference rather than storing the secret itself in App Configuration.

Exam distinction

If the question asks:

Where should an API secret be stored?

Think:

Azure Key Vault

If it asks:

Where should application configuration and feature flags be centrally managed?

Think:

Azure App Configuration

11. Feature Flags

Azure App Configuration also provides feature management.

A feature flag controls whether functionality is enabled.

Conceptually:

if (NewSearchFeatureEnabled)
{
    // New implementation
}
else
{
    // Existing implementation
}

This allows application code to be deployed independently from feature availability.

For example, a new AI-powered search feature could be deployed but initially disabled:

NewAISearch = OFF

Later:

NewAISearch = ON

No application redeployment is necessarily required just to change the feature flag.

12. Why Feature Flags Are Useful

Feature flags can support:

Dark deployment

Deploy code without exposing it to users.

Gradual rollout

Enable functionality for an increasing percentage of users.

A/B testing

Compare different implementations or experiences.

Emergency disablement

Turn off problematic functionality without redeploying the application.

Targeted releases

Enable functionality for particular users or groups.

Azure App Configuration supports feature filters, including targeting and time-window scenarios. Custom filters can also be implemented.

13. Dynamic Configuration

One of the most valuable capabilities of App Configuration is dynamic configuration.

Normally, an application might load configuration during startup:

Application starts
       ↓
Load configuration
       ↓
Run application

If configuration changes afterward, the application might continue using the old value until it restarts.

Dynamic configuration changes this behavior:

Application starts
       ↓
Load configuration
       ↓
Run application
       ↓
Configuration changes
       ↓
Refresh
       ↓
Application uses new configuration

Supported client libraries can refresh configuration without restarting the application.

14. Refresh Is Not Automatic by Default

This is an important exam concept.

Simply loading configuration from App Configuration does not mean that every configuration value is automatically monitored for changes.

For the .NET provider, for example, you explicitly configure refresh behavior using ConfigureRefresh and register the keys that should be monitored.

Two important patterns are:

• Register all selected keys
• Register a specific key as a refresh trigger

15. RegisterAll

RegisterAll() tells the configuration provider to monitor the selected key-values for changes.

Conceptually:

ConfigureRefresh
      |
      +-- RegisterAll()

When a selected value changes, the provider can refresh the configuration.

A refresh interval can also be configured to prevent excessive requests.

For example, the .NET provider supports:

SetRefreshInterval(...)

The default refresh interval for the provider is 30 seconds if one isn’t explicitly configured.

16. Sentinel Keys

A sentinel key is an especially important pattern for managing changes to multiple configuration values.

Suppose you need to change:

AI:Model
AI:Temperature
AI:MaxTokens
AI:TopP

You don’t necessarily want the application to reload after each individual change.

Instead, create a sentinel key:

AI:Settings:Sentinel

Update the configuration values first:

AI:Model
AI:Temperature
AI:MaxTokens
AI:TopP

Then update:

AI:Settings:Sentinel

The application monitors the sentinel key.

When it changes, the application refreshes the configuration.

Change settings
      ↓
Change sentinel
      ↓
Sentinel detected
      ↓
Refresh configuration
      ↓
All settings loaded together

This helps ensure that a group of related configuration changes becomes active together. It also reduces unnecessary monitoring of every individual key.

Exam tip

If a question says:

“Several configuration values must be changed together, and the application should refresh only after all changes have been completed.”

Think:

Sentinel key.

17. Configuration Refresh and Caching

App Configuration clients can cache configuration locally.

This provides an important resilience benefit.

If a refresh attempt fails, applications using the supported provider can continue using their cached configuration rather than immediately failing because App Configuration could not be contacted.

This is important for production applications because configuration services should not unnecessarily become a single point of failure for application execution.

18. Event-Driven Configuration Updates

App Configuration can also emit events when key-values change.

These events can be delivered through Azure Event Grid.

For example:

App Configuration
       |
       | configuration changed
       v
   Event Grid
       |
       +--------> Azure Function
       |
       +--------> Logic App
       |
       +--------> HTTP endpoint

This can be used to trigger workflows such as:

• Configuration refresh
• Deployment automation
• Cache invalidation
• Operational notifications

This is different from an application simply polling the configuration store for changes.

19. Common Configuration Architecture

A production AI application might use the following architecture:

                    Azure App Configuration
                     /                 \
                    /                   \
             Application              Feature Flags
              Settings
                 |
                 | Key Vault reference
                 v
             Azure Key Vault
                 |
               Secrets

For example:

App Configuration

AI:Endpoint
AI:Model
AI:Temperature
Database:Endpoint
Logging:Level
FeatureManagement:NewSearch

Key Vault

DatabasePassword
ExternalApiKey
ThirdPartySecret

The application accesses both using its managed identity.

20. App Configuration vs. Environment Variables

Environment variables are still useful for many applications, particularly for simple deployment-specific configuration.

However, App Configuration becomes valuable when:

• Multiple applications need the same settings
• Configuration must be centrally managed
• Different environments need different values
• Feature flags are required
• Configuration needs to change dynamically
• Configuration needs centralized governance

A typical architecture might use environment variables for bootstrapping information while App Configuration provides the application’s broader configuration.

21. App Configuration vs. Configuration Files

Traditional application:

appsettings.json
       ↓
Application

Centralized configuration:

Azure App Configuration
       ↓
Application

The second approach is particularly valuable in distributed environments where many application instances need consistent configuration.

For example, imagine 50 containers running an AI API.

With local configuration files, changing an AI model endpoint could require updating and redeploying the application.

With App Configuration, the setting can be changed centrally and, when dynamic refresh is configured, propagated to the running applications.

22. Best Practices

1. Don’t store secrets directly in App Configuration

Use Key Vault for secrets.

2. Use managed identities

Avoid hard-coded credentials and unnecessary connection strings.

3. Establish a consistent key naming convention

For example:

AI:Model
AI:Endpoint
AI:Temperature
Database:Endpoint
Database:Timeout

4. Use labels for environment-specific configuration

For example:

Development
Test
Production

5. Use feature flags for controlled releases

Separate feature deployment from feature activation.

6. Use dynamic refresh when appropriate

This avoids unnecessary application restarts for configuration changes.

7. Use sentinel keys for coordinated updates

This is particularly useful when several settings must change as one logical configuration update.

8. Avoid excessively frequent refresh operations

Configure an appropriate refresh interval.

9. Design for temporary App Configuration unavailability

Use supported caching and resilience mechanisms rather than assuming the service will always be reachable.

10. Use least privilege

Grant applications only the permissions they require.

23. Important AI-200 Concepts to Remember

24. Common Exam Traps

Trap 1: “Store secrets in App Configuration”

Incorrect.

Use Key Vault for secrets.

Trap 2: “Changing a key automatically reloads every application”

Incorrect.

The application must be configured to support dynamic refresh.

Trap 3: “Use a separate key for every environment”

Not necessarily.

Labels are specifically designed to support scenarios such as:

Key = Database:Endpoint
Label = Development
Label = Test
Label = Production

Trap 4: “Use RegisterAll for coordinated multi-key changes”

It can work, but a sentinel key is often the better pattern when several settings must become active together.

Trap 5: “App Configuration replaces Key Vault”

Incorrect.

The services complement one another.

Trap 6: “Feature flags require redeployment”

Incorrect.

Feature management is specifically intended to decouple feature availability from code deployment.

Practice Exam Questions

Question 1

An AI application stores the following settings in Azure App Configuration:

AI:Model
AI:Temperature
AI:MaxTokens

The development and production environments need different values for these settings. You want to use the same key names in both environments.

What should you use?

A. Separate App Configuration stores for every key

B. Labels

C. Azure Key Vault versions

D. Feature filters

Answer: B

Explanation

Labels allow the same key to have different values depending on the environment or configuration context.

For example:

AI:Model / Development
AI:Model / Production

Feature filters are intended primarily for controlling feature availability, not general environment-specific configuration. Key Vault versions are not the mechanism for environment-specific App Configuration values.

Question 2

An Azure Function needs to retrieve application configuration from Azure App Configuration. The organization does not want credentials stored in application code.

Which authentication approach should you recommend?

A. Store the App Configuration connection string in source control

B. Use a managed identity with appropriate permissions

C. Store the credentials in an application JSON file

D. Embed a client secret directly in the Function code

Answer: B

Explanation

A managed identity allows an Azure-hosted application to authenticate to Azure resources without storing credentials in application code.

The identity should be granted the minimum permissions necessary to read the required configuration.

Question 3

An application has five configuration settings that must be changed together. The application must not reload the configuration until all five settings have been updated.

What is the best approach?

A. Restart the application after every setting change

B. Increase the size of the configuration values

C. Use a sentinel key as the refresh trigger

D. Store all five settings in a single environment variable

Answer: C

Explanation

A sentinel key is designed for this scenario. The application monitors the sentinel instead of using every individual setting as the refresh trigger.

The administrator changes the five settings and then changes the sentinel key. The sentinel change causes the application to refresh the related configuration.

Question 4

An organization needs to store an API password used by an AI application.

Which Azure service should primarily be used to store the password?

A. Azure App Configuration

B. Azure Event Grid

C. Azure Key Vault

D. Azure Service Bus

Answer: C

Explanation

Azure Key Vault is designed for securely storing secrets such as passwords, API keys, certificates, and other sensitive information.

App Configuration should primarily manage application configuration and feature flags. It can reference secrets stored in Key Vault, but it shouldn’t be treated as the primary secret store.

Question 5

A development team wants to deploy a new AI-powered search capability to production but initially make it available only to selected users.

Which App Configuration capability is most appropriate?

A. Feature flags with feature filters

B. Key Vault certificates

C. Configuration snapshots

D. Azure Service Bus topics

Answer: A

Explanation

Feature flags separate feature activation from code deployment. Feature filters can determine whether a feature is enabled for particular users, groups, or other conditions.

This makes feature flags useful for controlled rollouts and experimentation.

Question 6

An application retrieves configuration from Azure App Configuration at startup. An administrator later changes a configuration value, but the running application continues using the old value.

What is the most likely reason?

A. App Configuration keys cannot be changed

B. The application has not been configured for dynamic refresh

C. Labels prevent configuration changes

D. App Configuration only supports configuration files

Answer: B

Explanation

Loading configuration at startup does not automatically mean that a running application will monitor for configuration changes.

Dynamic refresh must be explicitly configured using the appropriate provider and refresh mechanism.

Question 7

A team wants configuration values to follow a consistent namespace such as:

AI:Model
AI:Temperature
AI:MaxTokens
Database:Endpoint
Database:Timeout

What is the primary purpose of this naming approach?

A. It creates Azure RBAC roles automatically

B. It encrypts configuration values

C. It provides a logical organization for configuration keys

D. It creates separate App Configuration stores

Answer: C

Explanation

App Configuration treats keys as strings, but developers can use delimiters such as : or / to establish logical namespaces.

This makes configuration easier to organize, query, and consume.

Question 8

An application uses the .NET App Configuration provider. Developers want the provider to check for configuration changes no more frequently than every 60 seconds.

Which configuration concept should they use?

A. A feature filter

B. A label

C. A Key Vault reference

D. A refresh interval

Answer: D

Explanation

The refresh interval controls how frequently the provider checks for configuration updates.

For example, the .NET provider supports SetRefreshInterval(...) to establish the minimum interval between refresh checks.

Question 9

A company wants to respond automatically whenever an App Configuration key-value changes. The workflow should invoke an Azure Function.

Which architecture is most appropriate?

A. App Configuration → Event Grid → Azure Function

B. App Configuration → Key Vault → Azure Function

C. App Configuration → Service Bus → Key Vault

D. App Configuration → Azure Storage → Key Vault

Answer: A

Explanation

Azure App Configuration can emit events when key-values change. Azure Event Grid can deliver those events to subscribers such as Azure Functions.

This provides an event-driven architecture without requiring the application to continuously poll for changes.

Question 10

An organization has the following requirements:

• Store application settings centrally.
• Store feature flags.
• Store database endpoints and AI model configuration.
• Store database passwords securely.
• Allow applications to access resources without embedded credentials.

Which architecture best satisfies the requirements?

A. Store everything in App Configuration and use connection strings in application code

B. Store everything in Key Vault and use hard-coded credentials for access

C. Store application settings and feature flags in App Configuration, secrets in Key Vault, and use managed identities

D. Store application settings in environment variables and secrets in source control

Answer: C

Explanation

This architecture follows the intended separation of responsibilities:

• Azure App Configuration → application settings and feature flags
• Azure Key Vault → secrets
• Managed identities → secure authentication without embedding credentials

This is the strongest option from both security and configuration-management perspectives.

Final AI-200 Exam Takeaways

For this topic, make sure you can quickly distinguish the following:

App Configuration = application configuration and feature management.

Key Vault = secrets.

Labels = different values for the same key.

Feature flags = control feature availability.

Managed identity = secure application authentication to Azure resources.

Dynamic refresh = update configuration without restarting the application.

RegisterAll() = monitor selected configuration values for changes.

Sentinel key = trigger a coordinated refresh after multiple configuration changes.

Refresh interval = control how frequently refresh checks occur.

Event Grid = react to App Configuration change events.

The most important architectural idea is that configuration should be externalized from application code, centrally managed, appropriately secured, and—when necessary—capable of being updated without requiring application redeployment or restart. Azure App Configuration is designed specifically to provide that centralized configuration layer, while Key Vault handles the sensitive secrets that applications depend on.

Go to the AI-200 Exam Prep Hub main page