Retrieve Azure Key Vault Secret in C# and .NET Core: A Complete Guide

In this article, we will explore how to retrieve an Azure Key Vault secret using C# and .NET Core. You will learn how to create an Azure Key Vault, configure the required permissions, install the necessary NuGet packages, authenticate your application using Microsoft Entra ID, and retrieve a secret using the SecretClient class. We will also cover error handling and best practices for securely managing secrets in your .NET applications.

By the end of this guide, you will understand how to integrate Azure Key Vault with a C# application and access sensitive configuration values without hardcoding them in your code.

Getting Started

Azure Key Vault is a cloud-based service provided by Microsoft Azure that helps developers securely store and manage sensitive information such as passwords, connection strings, API keys, and application secrets. Instead of storing sensitive values directly in source code or configuration files, applications can retrieve them securely from Azure Key Vault at runtime.

What is a secret?

A secret is sensitive information that is stored securely and used by an application to authenticate, authorize access, or connect to another service. In Azure Key Vault, secrets are used to store confidential values such as passwords, connection strings, API keys, and authentication tokens.

For example, suppose you are developing a C# .NET application that connects to a SQL Server database. Instead of hardcoding the database password in your source code, you can store it in Azure Key Vault and retrieve it securely when your application needs it.

Examples of secrets in Azure Key Vault

• Database connection strings: Connection details and credentials required to connect to a database.
• API keys: Keys used to authenticate requests to external services.
• Passwords: Credentials used by applications to access protected resources.
• Authentication tokens: Sensitive tokens used to authenticate with other services.

Important: A secret is not the same as an Azure Key Vault key. A secret stores a sensitive value, whereas a key is primarily used for cryptographic operations.

Retrieve Azure Key Vault Secret in C# and .NET Core

This example uses the Azure SDK for .NET and works with modern .NET versions that support the required packages.

Prerequisites

• An active Azure subscription.
• An Azure Key Vault containing a secret.
• A C# and .NET application.
• Appropriate permissions to read secrets.
• The .NET SDK compatible with your project.

Run the following commands in the Package Manager Console and Install the NuGet packages:

</> Bash
dotnet add package Azure.Security.KeyVault.Secrets
dotnet add package Azure.Identity

• Azure.Security.KeyVault.Secrets provides the client classes used to manage and retrieve secrets.
• Azure.Identity provides authentication mechanisms, including DefaultAzureCredential.

Create the C# example

</> C#
using System;
using System.Threading.Tasks;
using Azure;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
namespace AzureKeyVaultSecretExample
{
  class Program
  {
    static async Task Main(string[] args)
    {
      string keyVaultUrl =
      "https://your-vault-name.vault.azure.net/";
      string secretName = "DatabaseConnectionString";
      try
      {
        // Authenticate using Microsoft Entra ID
        var credential = new DefaultAzureCredential();
        // Create the SecretClient
        var client = new SecretClient(
        new Uri(keyVaultUrl),
        credential);
        // Retrieve the secret
        KeyVaultSecret secret =
        (await client.GetSecretAsync(secretName)).Value;
        // Access the secret value
        string secretValue = secret.Value;
        Console.WriteLine("Secret retrieved successfully.");
        // Use secretValue where required.
        // Avoid printing sensitive values in production.
      }
      catch (RequestFailedException ex)
      {
        Console.WriteLine(
        $"Azure Key Vault error: {ex.Status} - {ex.Message}");
      }
      catch (Exception ex)
      {
        Console.WriteLine(
        $"An unexpected error occurred: {ex.Message}");
      }
    }
  }
}

Important: Replace your-vault-name with your actual Key Vault name and ensure the identity used by DefaultAzureCredential has permission to read secrets. For local development, you can authenticate using Azure CLI (az login) or another supported credential. In Azure, a managed identity is generally preferable when available.

Also, DefaultAzureCredential supports several authentication mechanisms, so the identity selected depends on your environment and credential configuration.

Summary

Azure Key Vault provides a secure and reliable way to manage sensitive application data without embedding secrets directly in source code. By using the Azure.Security.KeyVault.Secrets and Azure.Identity packages, developers can authenticate with Microsoft Entra ID and retrieve secrets from Azure Key Vault using C# and .NET.

In this guide, we explored how to configure Azure Key Vault, install the required packages, retrieve a secret using SecretClient, and handle common errors. You can extend this example to retrieve database connection strings, API keys, and other sensitive configuration values in your .NET applications.

For production applications, follow security best practices by using managed identities where possible, granting only the required permissions, and avoiding the exposure of secret values in logs or error messages.

Thanks