---
title: Securing your Azure DevOps Pipelines
description: "Thanks to the [Azure Key Vault task](https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-key-vault?view=azure-devops&WT.mc_id=DOP-MVP-5003976) (which is [open source like many other tasks](https://github.com/microsoft/azure-pipelines-tasks)) getting a secret from a Key Vault has no secret ([badum tssss](https://www.youtube.com/watch?v=ObpcGNCU944)). ### Create a Key Vault Go to your Azure subscription and look for…"
url: "https://ariste.info/dynamics365almguide/securing-your-azure-devops-pipelines/"
updated: "2024-08-25"
category: Legacy Guide / Secure your Azure Pipelines with Azure Key Vault
---

# Securing your Azure DevOps Pipelines

Thanks to the [Azure Key Vault task](https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-key-vault?view=azure-devops&WT.mc_id=DOP-MVP-5003976) (which is [open source like many other tasks](https://github.com/microsoft/azure-pipelines-tasks)) getting a secret from a Key Vault has no secret ([badum tssss](https://www.youtube.com/watch?v=ObpcGNCU944)).

### Create a Key Vault

   Go to your Azure subscription and look for Key Vaults in the top search bar. If you don't have an Azure subscription you can get one **free with a credit of 170€/200$ for 30 days** and try this or other things.   In the Key Vault page click on "Create key vault" and fill the fields![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-13_54_14-Create-key-vault-Microsoft-Azure.png)   You can go through other tabs but I will just click "Review & Create" to create the vault.

### Add the task to DevOps

   Now go to Azure DevOps and create a new pipeline or edit an existing one. Add a task to the agent job and look for azure key vault:

![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-13_57_08-New-release-pipeline-Pipelines.png)

   It's possible that you might need to get the task from the marketplace first, if so remember you need to have enough right on the organization and not only the AZDO project you're in. Now go to the task and select your subscription:

![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-14_00_18-New-release-pipeline-Pipelines.png)

   Once selected click the "Authorize" button. **This will create a service principal in your subscription**, we'll use it later. After authorizing you just need to select the key vault you've created in the first step. And back to Azure.

### Setup and secret creation

   Go to your key vault, "Access policies" and click "Add Access Policy":

![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-14_05_51-aaristeDevOps-Access-policies-Microsoft-Azure.png)

   When we authorized the task to access our Azure subscription it created a service principal now we need to select it to **list and get the secrets** to be able to use them in our pipeline. Click on "Select principal":

![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-14_08_17-Add-access-policy-Microsoft-Azure.png)

   In the search bar type your subscription's name, the principal should start with it and end with the same ID of your subscription. Select it and click the "Select" button at the bottom:

![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-14_10_21-axz-dev01dev.northeurope.cloudapp.azure_.com_61012-Remote-Desktop-Connection.png)

   Now click on the "Secret permissions" lookup and under "Secret Management Operations" select Get and List:

![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-14_12_13-Add-access-policy-Microsoft-Azure.png)

   If you want to also use certificates or keys you should do the same. Finally click the "Add" button and **don't forget to click "Save"!!** Otherwise nothing will be saved:

![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-14_13_42-aaristeDevOps-Access-policies-Microsoft-Azure.png)

   Now we can create a secret in the key vault. Go to secrets and click on "Generate/Import", complete the fields and finally click on the "Create" button:

![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-14_15_55-Create-a-secret-Microsoft-Azure.png)

### Using the secrets in your pipelines

   We're ready to use the secret in our pipeline. I will add a PowerShell task to call the LCS DB API using d365fo.tools but I'll change all the variables to the secrets:

```
# Write your PowerShell commands here.
Install-PackageProvider nuget -Scope CurrentUser -Force -Confirm:$false

Install-Module -Name AZ -AllowClobber -Scope CurrentUser -Force -Confirm:$False -SkipPublisherCheck

Install-Module -Name d365fo.tools -AllowClobber -Scope CurrentUser -Force -Confirm:$false

Get-D365LcsApiToken -ClientId "$(myAppId)" -Username "$(myUserName)" -Password "$(mySecretPassword)" -LcsApiUri "https://lcsapi.lcs.dynamics.com" -Verbose | Set-D365LcsApiConfig -ProjectId $(myProjectId)

Get-D365LcsDatabaseBackups
```

   As you can see now even the AAD App Id is masked.   What the Azure Key Vault task does is getting the secrets from Azure and storing them in variables when the pipeline runs:

![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-14_23_26-New-release-pipeline-1-Release-1-Pipelines.png)

   Then we can access it's value with the $(variableName) notation in the PowerShell script. If you try to print the secrets' values using the Write-Host command all you'll get will be three asterisks, so you can see that using the Key Vault is more than safe. If we check the result of running the Get-D365LcsDatabaseBackups command we'll see how good is this:

![Securing your Azure DevOps Pipelines](http://ariste.info/wp-content/uploads/2020/02/2020-02-08-14_28_01-New-release-pipeline-1-Release-1-Pipelines.png)

   The ProjectId value **is not printed because it was one of our secret values**!   And this is how you can add extra security to your Dev ALM!

#### Subscribe!

Receive an email when a new post is published