Key Vault permission on secrets that allows a single secret to be read; App Service Key Vault references need nothing beyond it.
Also called secret permission.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Get in context, with comparison tables and the common traps.
Terms in this definition
- Access policies
Older permission model for Key Vault, now superseded by the Azure RBAC model.
- Secret
Object in Key Vault storing an arbitrary string value, for instance a password, API key or connection string.
- CRUD
Shorthand for create, read, update and delete, the four basic things you do with data. Data-plane roles in Azure Cosmos DB, for instance, authorise those operations on items.
- App Service
Managed PaaS hosting for web apps and Web App for Containers, run in a sandbox without OS access. Deployment slots and autoscale start at the Standard tier.
- Key Vault references
With app settings written as
@Microsoft.KeyVault(...), App Service and Azure Functions pull secret values from Key Vault, so no code change is needed.
Related terms
- A3
The licensing level for education that mirrors E3. Customers on Microsoft 365 A3 get Defender for Endpoint Plan 1, and its Windows Education A3 element is one of the qualifying licences for both Remediations and Windows Autopatch.
- ADLS Gen2
Short for Azure Data Lake Storage Gen2: a standard GPv2 account with hierarchical namespace turned on, so analytics workloads get true directories and POSIX-style ACLs.
- Agent instructions
System message of an agent defining its role, objectives, tone and boundaries; it also steers, though not deterministically, when tools get called.
- Analyze feature
Right-click a point on a line or bar chart to get machine-learning explanations of why it rose, fell or is distributed differently, with the contributing categories ranked against the previous point. Models using DirectQuery or row-level security can't use it.
- Application-enforced restrictions
Lets Exchange Online or SharePoint Online learn whether a device is managed and compliant: on such devices users get everything, while elsewhere they get a cut-down experience such as browser-only access. It is a Conditional Access session control.
- AuditEvent
Category of Key Vault resource logs that tracks each data-plane get, set or delete, noting who called, from which IP address, and whether it succeeded.
- Autocomplete
Query API in Azure AI Search that finishes partially typed terms using suggester fields, invoked with suggesterName. To get matching documents back, use Suggestions instead.
- Automated Backup
Feature of the SQL IaaS Agent extension: SQL Server instances on Azure VMs get backed up into a storage account.