In Microsoft Azure one can store secret values like passwords in Azure Key Vault, but also as encrypted variables in Azure Automation (these ones are stored in an Azure-managed Key Vault behind the scenes).

From a solution design perspective, if Azure Automation is used to trigger all the solution code executions, is there a good reason to use a Key Vault at all? Why not use the Automation Account variable storage to hold, manage, and retrieve my passwords from for insertion into code at execution time.

Or is it rather best practice to always use the Key Vault to store resource passwords (e.g. for deployment and access of VM, SQL Server)? If so, what is the rationale behind it?

1 Answer 1


Had been exploring Azure Automation Account's (AAC) assets 'Variables' (encrypted and plain) and 'Credentials'. My conclusion for my situation is that using the AAC-only to store and retrieve resource passwords and variable values is clean, sufficient, and less complex than using an additional Azure Key Vault resource for passwords in the solution design.

Also, on AAC one can store and manage variables and credentials independently from the run books that use them (principle of loose coupling).

Note that encrypted assets needs to be accessed via a ServicePrincipal account (to have the encryption keys retrieved from a system-managed Key Vault), so using the AAC environment for code execution is mandatory.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.