Multiple agents need database credentials and third-party API secrets. Developers currently paste secrets into agent environment variables in plain text and rarely rotate them. Which approach meets security requirements for multi-agent solutions on Azure?
Select an answer to reveal the explanation.
Short Explanation
Correct answer: A. Secrets belong in Azure Key Vault with per-agent identity, least privilege, rotation, and runtime retrieval—not plain env sprawl. Zips in public docs (B), Teams pins (C), and secrets inside system prompts (D) are severe leaks and unmanageable. Agents should use managed identities or workload identities to fetch only what they need, and prompts must never contain credentials.
Full Explanation
Secrets management for multi-agent solutions on Azure centers on Key Vault: secrets/certificates, rotation, RBAC to secrets, and encryption, with runtime retrieval. Option A matches that pattern and prevents prompt or config leakage. Options B–D distribute secrets through insecure channels or model context, creating exfiltration and audit failures. Combine Key Vault with managed identities per agent, deny broad secret-list permissions, and monitor access. Rotate on schedule and after any suspected exposure.