Secure your Azure App Configuration

Azure App Configuration provides capabilities to centrally manage application settings and feature flags with point-in-time configuration snapshots. When deploying this service, it's important to follow security best practices to protect data, configurations, and infrastructure.

This article provides guidance on how to best secure your Azure App Configuration deployment.

The security recommendations in this article implement Zero Trust principles: "Verify explicitly", "Use least privilege access", and "Assume breach". For comprehensive Zero Trust guidance, see the Zero Trust Guidance Center.

Service-specific security

App Configuration provides unique security capabilities designed specifically for configuration management, feature flag operations, and application settings protection.

• Implement safe deployment practices: Use configuration snapshots and progressive deployment models to minimize the impact of configuration changes. Build and test snapshots before production deployment and maintain last-known-good configurations for rapid rollback. For more information, see Azure App Configuration best practices.

• Separate secrets from configuration data: Store secrets like connection strings, API keys, and certificates in Azure Key Vault and reference them from App Configuration rather than storing them directly. Key Vault provides hardware-level encryption, granular access policies, expiration management, and management operations such as certificate rotation. Use App Configuration for application settings, feature flags, and other configuration data that benefits from centralized management and point-in-time snapshots. For more information, see Tutorial: Use Key Vault references in an ASP.NET Core app.

• Configure Azure Resource Manager authentication mode: Set your App Configuration store's Azure Resource Manager authentication mode to Pass-through for automated deployments. This mode requires a combination of data plane and Azure Resource Manager management roles for data access, enables proper auditing attribution to deployment callers, and is essential for secure infrastructure-as-code deployments. Avoid the Local authentication mode, which has auditing limitations and security constraints. For more information, see Deployment overview.

Network security

Network security controls prevent unauthorized access to App Configuration stores and establish secure communication boundaries for configuration data access.

• Enable private endpoints: Eliminate public internet exposure by routing traffic through your virtual network using Azure Private Link. Private endpoints provide dedicated network interfaces that connect directly to App Configuration while preventing data exfiltration risks. For more information, see Use private endpoints for Azure App Configuration.

• Disable public network access: Block all internet-based connections when using private endpoints to prevent unauthorized access attempts and reduce your attack surface. Configure the service to deny public network access and force all communication through private endpoints. For more information, see Disable public access in Azure App Configuration.

• Configure network security groups for private endpoint subnets: When using private endpoints, apply network security groups (NSGs) to the subnets hosting the private endpoints to control traffic flow. Enable network policies on the private endpoint subnet and implement restrictive NSG rules to allow only necessary traffic to reach the App Configuration private endpoints. For more information, see Manage network policies for private endpoints.

• Use network security perimeter (private preview): Define a logical network isolation boundary for your App Configuration store and other PaaS resources using a network security perimeter. Network security perimeters provide centralized network access rule configuration, inbound and outbound access controls, and diagnostic logging for network traffic. This feature is in private preview with access limited to enrolled subscriptions, and you perform management-plane operations through Azure Resource Manager or the Azure CLI. For more information, see Network security perimeter for Azure App Configuration (preview).

Identity and access management

Identity and access management controls ensure that only authorized users and applications can access App Configuration resources with appropriate permissions for configuration data operations.

• Use Microsoft Entra ID authentication: Replace access keys with Microsoft Entra ID authentication to use centralized identity management, conditional access policies, and advanced security features. This authentication method provides better audit trails and eliminates long-lived secrets. For more information, see Access Azure App Configuration using Microsoft Entra ID.

• Implement role-based access control (RBAC): Assign users and applications the minimum required permissions by using built-in roles such as App Configuration Data Reader or App Configuration Data Owner rather than using administrative roles. For more information, see Azure built-in roles for Azure App Configuration.

• Enable managed identities: Configure system-assigned or user-assigned managed identities for applications to access App Configuration without storing credentials in code or configuration files. Managed identities provide automatic credential rotation and enhanced security. For more information, see How to use managed identities for Azure App Configuration.

• Disable access key authentication: Turn off access key authentication to enforce Microsoft Entra ID authentication for all configuration data access. This action eliminates the risk of compromised access keys and provides centralized identity management. For more information, see Disable access key authentication.

• Rotate access keys regularly: When access key authentication is required, implement regular key rotation to limit exposure from compromised credentials. Use both primary and secondary keys to enable seamless rotation without service interruption. For more information, see Access Azure App Configuration using access keys.

Data protection

Data protection mechanisms safeguard configuration information through encryption, key management, and secure storage practices for application settings and feature flags.

• Enable customer-managed keys for encryption: Configure customer-managed key (CMK) encryption by using Azure Key Vault to maintain control over encryption keys for configuration data at rest. This configuration provides extra protection beyond Microsoft-managed encryption and helps meet strict compliance requirements. For more information, see Use customer-managed keys to encrypt your App Configuration data.

• Configure automatic secret reload: Set up automatic reloading of secrets and certificates from Key Vault to ensure applications always use current values without manual intervention. This configuration reduces operational overhead while maintaining security. For more information, see Reload secrets and certificates from Key Vault automatically.

Logging and monitoring

Comprehensive logging and monitoring provide visibility into App Configuration operations, access patterns, and security events to enable threat detection and compliance oversight.

• Enable diagnostic logging: Configure diagnostic settings to collect App Configuration resource logs and metrics for security monitoring and compliance auditing. Send diagnostic data to Azure Monitor Logs, storage accounts, or Event Hubs for centralized analysis and retention. For more information, see Monitor Azure App Configuration.

• Monitor access patterns and configure alerts: Track configuration retrieval requests, modification events, and access frequencies to detect anomalous usage patterns that might indicate security threats or unauthorized access attempts. Set up Azure Monitor alerts to automatically notify you of suspicious activities such as failed authentication attempts, unusual request patterns, throttling events, and configuration modifications. This enables rapid response to potential security incidents through real-time monitoring and automated alerting. For more information, see Monitor Azure App Configuration and App Configuration Metrics and Logs Schema.

• Enable Azure Activity Log monitoring: Monitor Azure Activity Log for App Configuration resource changes, administrative actions, and control plane operations. Configure alerts for critical changes such as network access modifications or authentication setting updates. For more information, see Activity log in Azure Monitor.

• Monitor authentication and authorization failures: Set up monitoring and alerts for HTTP 401 (Unauthenticated) and 403 (Forbidden) responses to detect common security configuration issues. HTTP 401 errors often indicate invalid or rotated access keys that aren't updated in production applications, while HTTP 403 errors typically signal missing or incorrect role assignments for identities accessing App Configuration. Configure automated alerts for these error patterns to enable rapid detection and resolution of authentication and authorization problems. For more information, see Monitor Azure App Configuration and App Configuration Metrics and Logs Schema.

Compliance and governance

Compliance and governance controls ensure App Configuration deployments meet regulatory requirements and organizational policies through proper configuration management and audit capabilities.

• Apply Azure Policy definitions: Use Azure Policy to enforce security configurations and monitor compliance across App Configuration resources. Apply built-in policies for private link usage, access key restrictions, and encryption requirements. For more information, see Azure Policy Regulatory Compliance controls for Azure App Configuration.

• Implement resource tagging: Apply consistent resource tags to App Configuration stores for cost management, security monitoring, compliance tracking, and governance. Use tags to identify data classification, owner information, and regulatory requirements. For more information, see Use tags to organize your Azure resources.

• Enforce Conditional Access for App Configuration administrators: Apply Microsoft Entra Conditional Access policies that require multifactor authentication and compliant devices for identities that manage App Configuration stores - creating or deleting stores, changing network access and authentication settings, and assigning data-plane roles such as App Configuration Data Owner. For more information, see Require MFA for Azure management.

• Configure log retention for compliance: Route App Configuration diagnostic logs to a Log Analytics workspace or storage account and set a retention period that satisfies your regulatory obligations, preserving configuration-change and access records for the required duration. For more information, see Monitor Azure App Configuration.

Backup and recovery

Backup and recovery strategies protect App Configuration data and ensure business continuity through proper disaster recovery planning and geo-replication capabilities.

• Enable geo-replication for high availability: Create replicas of your App Configuration store across multiple Azure regions to provide redundancy and ensure availability during regional outages. Geo-replication automatically synchronizes configuration data across regions. For more information, see Geo-replication overview.

• Implement automatic failover mechanisms: Configure App Configuration provider libraries to automatically fail over between replicas during outages to maintain application availability without manual intervention. This approach provides seamless continuity for configuration-dependent applications. For more information, see Enable geo-replication.

• Deploy across regions and availability zones: Provision App Configuration stores in regions with Azure availability zone support to provide resilience against datacenter outages with automatic zone redundancy. Deploy replicas in regions where your applications run to minimize latency, distribute request load, and enhance resiliency against transient failures and regional outages. For more information, see Migrate App Configuration to a region with availability zone support and Resiliency and disaster recovery.

• Create configuration snapshots: Use point-in-time snapshots to create immutable configuration versions that you can use for rollback scenarios and safe deployment practices. Snapshots provide guaranteed consistency and enable rapid recovery from configuration errors. For more information, see Snapshots.

• Enable purge protection to prevent malicious deletion: Enable purge protection so a soft-deleted store can't be permanently purged during its retention period, protecting configuration data from malicious or accidental permanent deletion. Soft-delete is automatically enabled for all Standard and Premium tier App Configuration stores and retains deleted stores for a recovery period. Purge protection adds an extra safeguard that's especially important for production environments. For more information, see Recover deleted stores in Azure App Configuration.