Today in this article, we will see how to Import or copy Docker Container Images to Azure Private Registry using step by step guide.

Here you can use simple Azure CLI or Power CLI commands to copy or import ready images from a public registry like DockerHub.

We will see below how to import the Docker Images from DockerHub without using any docker commands.

Getting started – Import from Docker Hub

Please login to the Azure Cloud subscription account and have a resource group ready so as to use this feature.

Step 1- Create Azure container registry

If you already have ACR created you can skip this step.

Let’s use the below steps to create an Azure Container registry.

Command

az acr create --resource-group myResourceGroup
--name myRegistry --sku Basic

Example

az acr create --resource-group thecodebuzz-group --name TheCodeBuzzRegistry --sku basic

Step 2- Import Image from Docker Hub

I have the below images in the remote Docker hub.

Command

az acr import  --name myRegistry 
--source docker.io/<repo-name>/<image-name>:<tag-name> --image <image-name>:<tag-name>

OR

If You need to use a Docker username and password for authentication,

az acr import  --name myRegistry 
--source docker.io/<repo-name>/<image-name>:<tag-name> --image <image-name>:<tag-name> --username <username> --password <password>

Example

az acr import --name TheCodeBuzzRegistry --source docker.io/firstthecodebuzz/forazureacr:v1 --image forazureacr:v1 --username firstthecodebuzz --password *****



 

Once executed you shall be able to import the image into the Azure private registry. Please wait some time to get the import finished successfully.

Verify or List container images from Azure Registry

Please use the below command to list and verify available images in the Azure registry,

Command

az acr repository list --name myRegistryName --output table

Example

az acr repository list --name thecodebuzzregistry --output table

OR

az acr repository list --name thecodebuzzregistry.azurecr.io --output table

Finally, you shall see that your docker image was successfully imported from the docker hub to the Azure private registry.

References:

• Docker- Containerize an Angular App with NGNIX

Do you have any comments or ideas or any better suggestions to share?

Please sound off your comments below.

Happy Coding !!

Please bookmark this page and share it with your friends. Please Subscribe to the blog to receive notifications on freshly published (2026) best practices and guidelines for software design and development.

The post Copy Docker Container Images to Azure Private Registry first appeared on TheCodeBuzz.

Today in this article, we will see Azure – Get All Pull requests using ADO DevOps API feature in detail.

It’s easy to call Azure DevOps API and get the pull request details. One can automate the process using the AZ command or CLI or PowerShell script.

We will use the below API for the same.

Trigger an ADO build- using Queue API

GET API

GET https://dev.azure.com/{organization}/{project}/_apis/git/repositories/{repo-name}/pullrequests?&api-version=6.0

Build pipeline With optional parameters

GET API

https://dev.azure.com/jan2022-thecodebuzz/globalexceptionhandler/_apis/git/repositories/globalexceptionhandler/pullrequests?&api-version=6.0

In the above Post request below are the input parameters,

• organization – The name of the Azure DevOps organization.

• project – Project ID or project name

• api version – Version of the API to use.

Below is our sample repository,

https://dev.azure.com/jan2022-thecodebuzz/globalexceptionhandler/_build

Configuration and security

Let’s now configure the API to be invoked securely.

Step1- Click on the User settings and set up the personal access token.

Define a name for this token and authorize the scope of access with this token. You can choose this token access for the Build pipeline trigger or release pipeline trigger etc.

I have below sample 2 pull request

Once you execute the GET API, all metadata associated with Pull request can be accessed easily ,

References:

• Create HTTP with NGINX on Linux in Azure Virtual Machine

• Automating Azure DevOps Build Pipelines using Run Pipeline API

Please bookmark this page and share it with your friends. Please Subscribe to the blog to receive notifications on freshly published (2026) best practices and guidelines for software design and development.

The post Azure – Get All Pull requests using ADO DevOps API first appeared on TheCodeBuzz.

Today in this article, we will go over a few basic commands for Azure KeyVault – Create, Purge or Soft Delete or Recover secretes.

Using Portal to delete the Vault Secretes

f you need to delete an app secrete, then you can delete the secretes using the below option,

If you need to delete an app secrete then use the below command,

Command

az keyvault secret purge --name appsecret --vault-name newvault1000

Example

az keyvault secret purge --name appsecret --vault-name newvault1000

If the deletes are enabled as soft delete , means all the secretes deleted will go into a retention period and will be retained up to 90 days after the cut-off time.

Recover deleted secretes

Command

az keyvault secret recover --name appsecret --vault-name newvault1000

Example

az keyvault secret recover --name appsecret --vault-name newvault1000

Get the list of deleted secretes

Command

az keyvault secret list-deleted --vault-name newvault1000

Example

az keyvault secret list-deleted --vault-name thecodebuzz-key-vault

References :

• Secure secrets using Azure KeyVault MSI with examples

Do you have any comments or ideas or any better suggestions to share?

Please sound off your comments below.

Happy Coding !!

The post Azure KeyVault – Create, Purge or Soft Delete or Recover secretes first appeared on TheCodeBuzz.

Today in this article we will see how to secure secrets using Azure KeyVault using a non-MSI approach.

Updated October 2026: an RBAC permissions section, guidance on protecting the client secret and local development, and an FAQ.

Today in this article, we will cover below aspects,

Here we will use configuration values for the below variables declaratively,

• AZURE_CLIENT_ID,
• AZURE_TENANT_ID,
• AZURE_CLIENT_SECRET.

Let’s look into step by step how to get the above-used key vault URL and define secretes value for DbPassword.

Prerequisites

Before we get started with actual Azure Vault implementation please make sure you have the below prerequisites defined already in your Azure cloud account,

• Create a Resource group( if not already exist )
• Create an App Service plan
• Create Azure WebApp (App Service) in the App service plan

For more details on the above steps, please visit this article – Secure secrets using Azure KeyVault MSI with examples

Please make sure to define variables AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET as Environment variables or as Application settings are defined with values.

Get Value for AZURE_CLIENT_ID , AZURE_TENANT_ID , AZURE_CLIENT_SECRET

Let’s now see how to get value for “AZURE_CLIENT_ID”, “AZURE_CLIENT_SECRET”, “AZURE_TENANT_ID” .

All these IDs (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET ) are needed to authenticate/Identify the Application with Azure cloud.

To get the defined values please go to the Azure default directory and click on the Application object

Home -> Default Directory – > App registrations

So above,

• “AZURE_CLIENT_ID” is equal to Application(client) ID as defined in the above screenshot.

• “AZURE_TENANT_ID” is equal to Directory(tenant) ID as defined in the above screenshot.

So so far we got the value “AZURE_CLIENT_ID” and “AZURE_TENANT_ID” using the above-highlighted credentials.

Next “AZURE_CLIENT_SECRET” can be generated for the application object using the below steps.

Please go to Azure Directory- > App registration -> Click on your Application

Next click on the Certificates and Secretes -> Click on New Client Secretes

private IActionResult GetClientScrets()
        {
            SecretClientOptions options = new SecretClientOptions()
            {
                Retry =
                {
                    Delay= TimeSpan.FromSeconds(2),
                    MaxDelay = TimeSpan.FromSeconds(16),
                    MaxRetries = 5,
                    Mode = RetryMode.Exponential
                }
            };

            string keyVaultUrl = _configuration["VaultURI"];
            var client = new SecretClient(vaultUri: new Uri(keyVaultUrl), credential: new DefaultAzureCredential(),options);
            KeyVaultSecret secret = client.GetSecret("YourSecreteCode");
            return Ok("Your Secrete is " + secret.Value);
        }

Let’s now execute the WebApp URL and verify the Vault secrets.

Approach 2 – Authenticate the Application using MSI ( Managed Service Identity

We can bootstrap the authentication code within the ASP.NET API pipeline using managed service identity feature of the Azure cloud.

Managed Service Identity (MSI) is a technique to automatically manage the identity in Azure Active Directory(Azure AD). Key Vault service can be leveraged without having any token or credentials in your code which is generally needed as the first-time validation/authentication.

For more details please visit this article- Secure secrets using Azure KeyVault MSI with examples

Other references :

• Set Configuration in Azure using App Service

• Managing Configuration in ASP.NET Core

Please bookmark this page and share it with your friends. Please Subscribe to the blog to receive notifications on freshly published (2026) best practices and guidelines for software design and development.

Protect the client secret and run locally without it

The client secret is a credential, and it expires. Treat it like a password: keep it only in App Service application settings or environment variables, never in source control, and set a calendar reminder to rotate it before the expiry date.

How do you rotate an expiring client secret?

An expired secret is a common cause of authentication failures that appear suddenly with no code change. Rotate in this order so the app never has a gap:

1. Create: add a new client secret to the app registration.
2. Update: put the new value in the AZURE_CLIENT_SECRET setting and restart the app.
3. Delete: remove the old secret once the app works with the new one.

Which credentials are stronger than a client secret?

A client secret is a shared string that anyone can copy. These options reduce that risk:

• Certificate credential: harder to leak by accident, but you must manage certificate renewal.
• Federated credentials or workload identity: no stored secret at all, but the host must be able to issue a trusted token.
• Managed identity: Azure handles the credential for you, and it is the best choice when the host supports it.

The client secret is still reasonable for hosts outside Azure and for quick setups. Just keep its scope small and its lifetime short.

Should you use DefaultAzureCredential in production?

Use a narrower credential in production. DefaultAzureCredential is convenient, but it tries several credential types in sequence. Its environment credential is the one that reads AZURE_CLIENT_ID, AZURE_TENANT_ID and AZURE_CLIENT_SECRET.

When something fails, you then have to work out which of those attempts mattered. A single specific credential, or a ChainedTokenCredential with only the types you expect, gives you a shorter and clearer error.

In plain English: A credential chain is like trying keys on a ring until one opens the door. A short ring is quicker to check when the door stays shut.

How do you run locally without a client secret?

Put AzureCliCredential in the chain and sign in with az login. Your own account then reads the vault, so no secret is saved on your machine. Your account needs permission on the vault.

For developer-only values, layer user secrets on top of the Key Vault configuration source. Add them after the vault so they override it locally.

What should you check when authentication still fails?

• Reuse one client: SecretClient is thread-safe, so create one instance and share it instead of building a new one per request.
• Tenant ID: confirm AZURE_TENANT_ID is the directory that owns the app registration.
• Vault firewall: check the vault’s networking settings allow calls from your app’s network.

Frequently asked questions

Which RBAC role does an app need to read Azure Key Vault secrets?

Assign Key Vault Secrets User to the app’s service principal. It gives read-only access to secret values. If the app loads secrets through the AddAzureKeyVault configuration provider, also assign Key Vault Reader so the provider can list the secrets. Reader alone can’t read values, because it only sees metadata. Scope the role to the whole vault, or to a single secret if you want tighter control.

Why do I get 403 Forbidden from Key Vault right after granting access?

Role assignments can take several minutes to propagate, so wait a few minutes and retry first. If the 403 persists, check these:

• Access model: the vault must use RBAC rather than access policies, or your role assignment is ignored.
• Principal: the role must be assigned to the right service principal, the one behind your AZURE_CLIENT_ID.
• Tenant: AZURE_TENANT_ID must be the correct directory.
• Client secret: it must not have expired.
• Firewall: the vault’s network rules must allow the caller.

How do I name nested settings like Db:Password in Key Vault?

Use a double dash in the secret name. Key Vault secret names can’t contain colons, so you create a secret called Db--Password. When the Key Vault configuration provider loads it, the name maps to the configuration key Db:Password, and your existing IConfiguration code works unchanged.

Does the app pick up Key Vault secret changes without a restart?

Not by default. The configuration provider’s ReloadInterval option defaults to null, so secrets are loaded once at startup. Set ReloadInterval to a TimeSpan and the provider polls the vault for changes. If you call SecretClient directly, as in the example above, it reads the current value on every call, so decide deliberately how long to cache it. Create one SecretClient and reuse it rather than building a new one per request.

The post Secure secrets using Azure KeyVault -Approach II first appeared on TheCodeBuzz.

Today in this article, we will see how to Secure secrets using Azure KeyVault with examples. We will see step-by-step detailed examples of how to secure and use secretes using the KeyVault service.

Today in this article, we will cover below aspects,

We will see how to use Managed identity for accessing Azure Key vault resources and will also cover how to access Azure key vault resources without using the Managed identity.

We will use Azure portal and Azure CLI commands both ways to achieve the same.

In this tutorial, we will deploy the web application to Azure App Service. We will use the Azure Key Vault secret client library for .NET and the Azure CLI. 

Managed identity let you authenticate to any service inlcuding Key Vault that supports Azure AD authentication.

Also You need not have to store keys or secretes in the code.

You’ll use a managed identity to authenticate your Azure web app with an Azure key vault using

Azure KeyVault service is language agnostics (like any other Azure services offered) and can be used for .NET, JAVA, Node JS, and Python application as required.

Below discussed high-level steps can be followed in any language of your choice.

We will use a simple .NET API which will connect to Azure Vault to get the secured credentials like Connection string etc.

KeyVault lets you securely access secretes and sensitive information from within your applications. These Keys, secrets, and certificates are protected without you having to write the code yourself, and you can easily use them from your applications.

Authentication in Key Vault works using Azure Active Directory (Azure AD) where, Azure AD authenticates the identity of any given security principal.

Before we get started we will perform the basic configuration required for the Azure Key Vault service to function properly.

We will use a simple application that we will be hosting in Azure Cloud. This application will use the Vault to get the sensitive credentials.

Secure secrets using Azure KeyVault – Getting Started

Prerequisites

Before we get started with actual Azure Vault implementation please make sure you have the below prerequisites defined already in your Azure cloud account,

• Create a Resource group( if not already exist )
• Create an App Service plan
• Create Azure WebApp (App Service) in the App service plan

Azure Key Vault Service Setup

We can set up the Azure Key Vault service using multiple approaches.

We will mainly see two approaches i.e using Azure CLI and Azure Portal in this article

Create Azure Key Vault service using Azure Portal

Define configuration of KeyVault

Add Access policy using Managed Identity for Azure KeyVault

Please define the access policy as required for the vault service.

• Above I have defined only “Get” access to key vault service.

• For the “Select Principal” option, select the Azure Web App that you enabled Identity Management previously.

Once done your Vault account will be created successfully

Below highlighted URL is your AzureKy Vault URL.

Please make a note of Vault URI “https://thecodebuzz-key-vault.vault.azure.net/” this is going to be used on the C# logic to connect to Vault and fetch the secretes. We will see more on the same in the below section.

Add Secretes to KeyVault

Let’s now go to our Key Vault and add application secrete,

Above I have added new secretes called “YourSecreteCode” with a value of “you are beautiful“

Using Azure CLI for adding Managed Identity for the KeyVault service

Alternatively, If interested we can perform the above steps using CLI as well.

One can use the AZ CLI command to create an Azure Key Vault service account as below,

The below command can be used to create an Azure Key Vault account.

Command

az keyvault create --resource-group "thecodebuzz-group" --name "thecodebuzz-vault"

assign-identity command to create the identity for this application

Command

az webapp identity assign --name "<App-Service-Name>" --resource-group "<Resource-Group-Name>"

Example

az webapp identity assign --name "thecodebuzz-web-app-service" --resource-group "thecodebuzz-group" 

Once executed successfully,

You shall see the output below,

{
   "principalId": "4a6bdc47-xxx-4402-xxxx-fc2861108d1c",
   "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
   "type": "SystemAssigned"
 }

As a next step, please run the below command to set the policy.

• The web app application is given permission to do get or list operations on your key vault bypassing the principalID obtained above

Command

az keyvault set-policy --name '<key-Vault-Name>' --object-id <principalId> --secret-permissions get

Example

 az keyvault set-policy --name 'thecodebuzz-key-vault' --object-id '4a6bdc47-xxxx-4402-xxxx-fc2861108d1c' secret-permissions get 

Create ASP.NET Core API or MVC application using .NET 6 or .NET 5

Let’s create our sample application here. Our target will be to deploy the application cloud Azure app service associated with App Service Plan.

Add below two Nuget packages,

Install-Package Azure.Security.KeyVault.Secrets -Version 4.3.0

This library allows you to securely store and control access to tokens, passwords, API keys, and other secrets. This library offers operations to create, retrieve, update, delete, purge, backup, restore, and list the secrets and their versions.

and

Install-Package Azure.Identity -Version 1.6.0

This library provides Azure Active Directory token authentication support.

Please add below using namespaces,

using Azure.Identity;

using Azure.Security.KeyVault.Secrets;

You can use the same logic as it is Console/API or other type of Application as well

Open your project solution in Visual Studio. Go to Program.cs and add the below-highlighted code

public class Program
    {
        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        }

        public static IHostBuilder CreateHostBuilder(string[] args) =>
            Host.CreateDefaultBuilder(args)
            .ConfigureAppConfiguration((context, config) =>
            {
                var settings = config.Build();

                if (!context.HostingEnvironment.IsDevelopment())
                {
                    var keyVaultEndpoint = settings["VaultURI"];
                    if (!string.IsNullOrEmpty(keyVaultEndpoint))
                    {
                        var azureServiceTokenProvider = new AzureServiceTokenProvider();
                        var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
                        config.AddAzureKeyVault(keyVaultEndpoint, keyVaultClient, new DefaultKeyVaultSecretManager());
                    }
                }

            }).ConfigureWebHostDefaults(webBuilder =>
               {
                   webBuilder.UseStartup<Startup>();
               });
    }

That’s all. Now Azure Key Vault credentials will become part of your IConfiguration root object along with all available configurations.

The above steps will help you manage the azure credentials just like any other configuration and hence let you handle updates or edits to key vault secrets based on how you set your configuration in the API or Application pipeline.

For Accessing Azure Key Vault credentials you need to inject the IConfiguration interface in the required module of your choice.

Example

 public IActionResult Index()
        {

            string keyVaultUrl = _configuration["YourSecreteCode"];

            return Ok("Your Secrete is -" + keyVaultUrl);
        }

Similarly, if you hit the WebApp endpoint,

If you are interested to know non-msi approach by using enviornment variable setup , please visit below article- Secure secrets using Azure KeyVault -Approach II

Other references :

• Set Configuration in Azure using App Service

• Managing Configuration in ASP.NET Core

Do you have any comments or ideas or any better suggestions to share?

Please sound off your comments below.

Happy Coding !!

Please bookmark this page and share it with your friends. Please Subscribe to the blog to receive notifications on freshly published (2026) best practices and guidelines for software design and development.

The post Secure secrets using Azure KeyVault MSI with examples first appeared on TheCodeBuzz.