Forum Discussion
Best practice for managing client Id and secret when developing Azure Web app
Hi all.
I don't know where the best place to ask this is, but I'm developing an integration with Azure for Sharepoint access via graph api and its not entirely clear to me what the best practice is on who holds the Enterprise App client ID and secret token used by the 3rd party application that an admin grants consent to.
If you've done a bunch of direct backend integrations you typically manually create the Enterprise App, and add a token, then hand the generated app ID, client ID and token to the integration application to direct you through the consent URI step. At the point its up to you to manage the app's token which can expire.
My understanding is when you seek to develop an official MS Gallery App, it's the developer/vendor that sets up their own Azure Entra and manages their application's access to Graph. When an admin that uses your application wants to integrate it with Azure for whatever it does, they would pick the Gallery App, and everything related to Graph access is handled by the vendor/developers.
I believe this is separate because the vendor/developer may want to manage their own SaaS service install separate from the customer/admin, and I believe Microsoft also can revoke the vendor/developer's account/tokens as well if they're being malicious.
The admin can control what the app accesses in their Azure via access permissions and of course removing the app.
Is this a best practice? Where can I find guidance on who and where the secret is managed? Please remember this is related to the developer of a Gallery App, not a direct integration. I understand the direct integration, it's not how I believe a Gallery App is supposed to work exactly.
I believed you are in the right track:
- Use Azure Key Vault: Store your client secrets securely in Azure Key Vault. This ensures that sensitive information is encrypted and managed centrally. You can then access these secrets from your application without hardcoding them into your code.
- Rotate Secrets Regularly: Regularly rotate your secrets to minimize the risk of exposure. Azure Key Vault supports automated secret rotation, which can help you manage this process efficiently.
- Least Privilege Access: Ensure that only the necessary applications and services have access to the secrets. Use Azure role-based access control (RBAC) to grant minimal permissions required for the application to function.
- Monitor and Audit: Enable monitoring and auditing for access to secrets. This helps in detecting any unauthorized access and maintaining a secure environment.
- Centralize Identity Management: Integrate your on-premises and cloud directories for centralized identity management. This simplifies the management of credentials and access controls.
Best practices for secrets management - Azure Key Vault | Microsoft Learn
