Using Azure Key Vault for app secrets
Azure Key Vault use for app secrets in Business Central extensions: how to set up app key vaults for online and on-premises deployments, retrieve secrets in AL code, and monitor secret access with telemetry. It answers setup, permission, coding, and diagnostics questions.
Path: Development > Programming in the AL language > Handling security > Using Azure Key Vault for app secrets · tier official · system development · narrative reviewed (checked by Opus)
Overview
This section explains how extensions that call external web services can keep secrets in Azure Key Vault instead of in code. It starts with a conceptual page on app key vaults, which covers multi-key vault support, access control, publisher validation, and telemetry monitoring.
Setup depends on the deployment. For Business Central online, marketplace apps get access by provisioning the ISV key vault reader application and granting it secret permissions. For on-premises, you register the service in Microsoft Entra ID, use certificate authentication, and grant secret permissions. Container-based deployment is also covered.
The developer page shows how to configure key vault URLs in the app.json manifest and retrieve secrets with the App Key Vault Secret Provider codeunit. The telemetry page covers how to diagnose failures in initialization and secret retrieval. Start with the overview page, then follow the setup page for your deployment, then the coding page.
Key points
- App key vaults store secrets for extensions that call external web services, and multiple key vaults are supported.
- Online: provision the ISV key vault reader application (a Microsoft Entra service principal) and grant it secret permissions on the Azure key vault.
- Online setup references AllowedBusinessCentralAppIds to control which apps can access the secrets.
- On-premises: register in Microsoft Entra ID, use certificate authentication, and grant secret permissions; container-based deployment is covered.
- In AL, put key vault URLs in app.json, then call TryInitializeFromCurrentApp and GetSecret on the App Key Vault Secret Provider codeunit.
- Secrets are handled with the SecretText data type; the coding page lists runtime 6.0 and version 17.0.
- The coding page covers multi-vault failover and security considerations, and publisher validation applies to access.
- Telemetry traces App Key Vault initialization and secret retrieval, with success and failure tracking for diagnostics.
Learn pages
- App Key Vault Secret Trace Telemetry | Microsoft Docs: Learn about app key vault secret trace telemetry in Business Central
- Azure Key Vaults with Business Central: Provides an overview of Azure key vaults with Business Central extensions.
- Set up app key vaults for Business Central online: Learn how to set up Azure key vaults for Business Central online extensions. Follow step-by-step instructions to securely manage secrets for your Marketplace apps.
- Setting up App Key Vaults for Business Central on-premises: Describes how to set up App Key Vault with Business Central on-premises.
- Using Key Vault Secrets in Business Central Extensions: Describes how to use an Azure Key vault with Business Central extensions.
Videos, posts and code changes
Linked by a Haiku matcher with a grounding quote from the item’s summary (link/topics.ts); machine-generated.
- #8999 Migrate Recommended Apps & Connectivity Apps to Official Marketplace Catalog API (code change): “Integrated Azure Key Vault for secure API key management”
Source: Microsoft Learn (CC BY 4.0). Descriptions are Learn’s own.
What Learn documents here 5 Learn pages
- learnApp Key Vault Secret Trace Telemetry | Microsoft Docs2025-09-25
- learnAzure Key Vaults with Business Central2021-04-01
- learnSet up app key vaults for Business Central online2026-01-27
- learnSetting up App Key Vaults for Business Central on-premises2021-04-01
- learnUsing Key Vault Secrets in Business Central Extensions2024-08-20