MCP tool connectors need API keys and certificates. Developers currently paste secrets into container environment variables at build time and rebuild to rotate. What secrets-management approach should you design for multi-agent Azure deployments?
Select an answer to reveal the explanation.
Short Explanation
You need Azure Key Vault for secrets and certificates, with RBAC-restricted access, runtime retrieval by agent identities, encryption, and automated key rotation without prompt or image rewrites. That keeps credentials out of images, prompts, and logs, and lets you rotate keys without rebuilding containers.
Full Explanation
Design Key Vault-centered secret retrieval for tools and model credentials. Grant each agent identity only the secrets it needs; enable rotation; avoid putting secrets in prompts, repos, or immutable images. The approach that continues baking secrets into images and emails new keys in chat is incorrect because image-baked secrets couple rotation to redeploy and widen leakage paths. The approach that stores secrets in public blob storage with anonymous read is incorrect because public storage is not a secret store. The approach that prints secrets into agent traces at log level verbose permanently is incorrect because traces must redact credentials even when prompt tracing is enabled. Combine with network restrictions on Key Vault where required by policy.