Secrets Management Gone Wrong
Referencing Key Vault secrets directly in your configuration file looks elegant, but the runtime needs the Azure SDK to resolve those placeholders. If the SDK is missing or the app lacks the proper managed identity, startup throws a cryptic deserialization error.
Debugging the Startup Pipeline
First, confirm that the Azure.Extensions.AspNetCore.Configuration.Secrets package is installed and that your app is running with a system-assigned or user-assigned identity. Without that identity, the Key Vault client cannot authenticate, and the configuration provider silently returns empty values.
{
"$schema": "https://json.schemastore.org/appsettings",
"Logging": {
"LogLevel": {
"Default": "Information"
}
},
// This placeholder is resolved at runtime by the Azure Key Vault provider.
"ConnectionStrings": {
"DefaultConnection": "@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/db-conn)"
}
}
// Ensure the app has the Key Vault Secrets User role assigned in Azure RBAC.Check the host builder logs for "KeyVaultConfigurationProvider" entries. If you see authentication failures, switch to a connection string with an explicit client secret temporarily, just to verify the network path is open.
