Case study

Tailwind Traders — secrets, identity, and observability

Tailwind Traders operates a multi-tenant SaaS platform across App Service, Azure Functions, and AKS.

Secrets are currently a single Key Vault shared by every application and environment, and each service authenticates with a client secret stored in app settings. A recent near-miss saw a leaked secret grant access to production storage. Security has mandated that no application store a credential of any kind, and that a compromise of one workload must not expose another's secrets.

The database password must rotate every 60 days with zero downtime. An earlier attempt caused an outage because applications cached the old value and kept presenting a revoked credential.

On the observability side, one Application Insights resource is shared by all services, and during incidents the team cannot tell which service is failing or follow a request across service boundaries. Telemetry ingestion cost has also tripled year on year, and a daily cap was applied that silently created gaps in the data.

Requirements

No stored credentials in any application
A compromised workload must not reach another workload's secrets
60-day password rotation with no failed authentications
Attribute telemetry to a specific service and follow a request end to end
Reduce ingestion cost without losing representative data or creating gaps

Q43 Key Vault Domain 4 · 20–25% of exam Priority · Real Exam

A compromise of one workload must not expose another's secrets. Which change achieves this?

A Keep one vault but enable purge protection
B Separate vaults per application and environment, with scoped role assignments per identity (correct answer)
C Enable soft delete on the shared vault
D Switch the shared vault to the Premium tier

Shortcut: Isolation is a function of scope. A vault per application per environment means a stolen identity can read only that vault's contents, and it also isolates throttling limits. Soft delete, purge protection, and HSM tiers protect availability and key material, not blast radius.

A compromise of one workload must not expose another's secrets. Which change achieves this?

More Key Vault questions