Lab 16 - Using Azure Key Vault for Managed Identities

Lab scenario

When you use managed identities for Azure resources, your code can get access tokens to authenticate to resources that support Microsoft Entra authentication.  However, not all Azure services support Microsoft Entra authentication. To use managed identities for Azure resources with those services, store the service credentials in Azure Key Vault, and use the managed identity to access Key Vault to retrieve the credentials.

Estimated time: 35 minutes

Exercise 1 - Use Azure Key Vault to manage Virtual Machine identities

Task 1 - Create a Key Vault

Sign in to Microsoft Azure portal at https://portal.azure.com using a Global administrator account.
At the top of the left navigation bar, select + Create a resource.
In the Search the Marketplace box type in Key Vault.
Select Key Vault from the results.
Select Create.
Fill out all required information as shown below. Make sure that you choose the subscription that you’re using for this lab.

Note: The Key vault name must be unique. Look for a green checkmark to the right of the field.

Resource group - rgSC300KeyVault
Key vault name - anyuniquevalue

Select Next.

On the Access Configuration page, select the Vault Access Policy radio button.

Select Review + create.
Select Create.

Task 2 - Create a Windows Virtual Machine

Select + Create a resource.
Type Windows 11 in Search the Marketplace search bar.
Select Windows 11 and from the plan dropdown choose Windows 11 Enterprise, version 25H2 or any newer version. Then select Create.

Field	Values
VM Name	vmKeyVault
Availability options	No infrastructure redundancy required
Admin Username	adminKeyVault
Password	Set a secure password that you can remember
Licensing	Confirm you have an eligible license

Make sure you mark the Confirm licensing checkbox.
Use the Next button to get to the Management tab.
On the Management tab, check the box next to Enable system assigned managed identity.
Go through the rest of the experience of creating a virtual machine.
Select Review + Create then select Create.

Task 3 - Create a secret

Navigate to your newly created Key Vault.
Open Objects on the left menu then Select Secrets.
Select + Generate/Import.
In the Create a secret screen, from Upload options leave Manual selected.
Enter a name and value for the secret. The value can be anything you want.
Leave the activation date and expiration date clear, and leave Enabled as Yes.
Select Create to create the secret.

Task 4 - Grant access to Key Vault

Navigate to your newly created Key Vault
Select Access Policies from the menu on the left side.
Select + Create.
In the Add access policy section, under Configure from template (optional), choose Secret Management from the pull-down menu.
Use the Next button to move to the Principal tab.
In the search field enter the name of the VM you created in task 2 - vmKeyVault. Select the VM in the result list and choose Select.
Use the Next button to move to the Review + Create tab.
Select Create.

Task 5 - Access data with Key Vault secret with PowerShell

Go to vmKeyVault virtual machine, select Connect. Select Download RDP file, Keep the downloads file, Open the file and Connect. Then enter the password from Task 2 and select Yes on the Remote Desktop Connection. On Choose privacy settings for your device select Next then Accept.
Open the Windows 11 virtual machine deployed earlier in this lab. In the lab virtual machine, open PowerShell.

In PowerShell, invoke the web request on the tenant to get the token for the local host in the specific port for the VM.

 $Response = Invoke-RestMethod -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net' -Method GET -Headers @{Metadata="true"}

Next, extract the access token from the response.
```
 $KeyVaultToken = $Response.access_token
```
Run the following command to retrieve the secret from Key Vault using the access token:
Note Replace the placeholder values:
- <key-vault-name>: Get from the Key Vault Overview page in the Azure portal.
- <secret-name>: Get from the Secrets page in the Key Vault.
```
 Invoke-RestMethod -Uri https://<key-vault-name>.vault.azure.net/secrets/<secret-name>?api-version=2016-10-01 -Method GET -Headers @{Authorization="Bearer $KeyVaultToken"}
```

You should receive a response that looks like the following:

 'My Secret' https://mi-lab-vault.vault.azure.net/secrets/mi-test/50644e90b13249b584c44b9f712f2e51 @{enabled=True; created=16... }

Verify that the response includes the secret value, its URI, and attributes (for example, enabled and created), similar to the following:
```
 'My Secret' https://mi-lab-vault.vault.azure.net/secrets/mi-test/<version-id> @{enabled=True; created=...}
```
This secret can be used to authenticate to services that require a name and password.

Exercise summary

In this exercise, you created a Key Vault, deployed a virtual machine with a system-assigned managed identity, granted it access to the vault, and retrieved a secret using the managed identity. This exercise showed how to access secrets without storing credentials in code.