[CoE Starter Kit - Azure Key Vault Configuration and security concerns about coe-starter-kit

[Jenefer-Monroe]

I'm afraid this is really a question for the product organization. We are just using this feature.
Here is the starter documentation for it, hope that is helpful. Use environment variables for Azure Key Vault secrets

[whorn76]

I guess I understand the limitation and its limitation from the product side. I'm wonder if it might make more sense for the COE to reach out to the Key vault in the flow and grab the secret on the fly rather than storing it in the Dataverse and requiring the dataverse to have access to the key vault. To me that would be more secure because then you could secure the vault down to a single user/service principle per vault. The customer had that concern and it would eliminate that concern regarding the COE, but it would still exist for any other vault configuration for Dataverse that would have to be addressed by the PG. Thanks for listening!

[Jenefer-Monroe]

Happy to listen. We won't be shifting to this for the kit as we want to use the out of the box features as they exist when possible. I do suggest you get this feedback to the product team though in whatever mechanisms you have available. And perhaps ask around in the power users community if others have heard the same concern https://powerusers.microsoft.com

[Jenefer-Monroe]

closing out as no further action for starter kit team