Internal agent-tool services need mutual TLS using a certificate the city manages centrally. Where should the certificate live?

Internal agent-tool services that need mutual TLS with a centrally managed city certificate should store and retrieve that certificate from Azure Key Vault. Key Vault Certificates manage issuance/import, versions, policy, and access via managed identity so each agent-tool service loads the current cert/private key material without USB sprawl. Central lifecycle supports rotation, auditing, and consistent trust across municipal internal mTLS meshes.

Emailing PFX files to each developer and keeping copies on USB drives fails centralized management—distribution is uncontrolled, copies proliferate, and revocation/rotation cannot be enforced. Disabling TLS between internal services because they share a VNet fails the mTLS requirement: network proximity is not cryptographic service identity, and VNet compromise would expose plaintext internal AI tool calls. Hardcoding a self-signed cert private key into every container image fails secrecy and rotation: image layers permanently contain key material and every replica shares the same long-lived key.

Exam caveat: Key Vault can store certificates, but applications must be coded/configured to fetch and reload them; merely uploading a cert does not automatically enable mTLS on every service. Distinguish Key Vault certificate objects from secrets that happen to hold PEM blobs—both appear in scenarios. Private endpoints and RBAC still apply to certificate Get/List operations.

Operational check: import or create the mTLS cert in Key Vault, grant agent-tool identities certificate/secret get as required, load the cert in two services, verify successful mTLS handshake, rotate to a new version, and confirm services pick up the new version without emailing PFX files.