Several Foundry agents retrieve third-party API keys and certificates at runtime. Today secrets are stored in a shared configuration map baked into container images, and rotation requires rebuilding every agent image. Which approach best meets secrets management requirements for multi-agent solutions on Azure?
Select an answer to reveal the explanation.
Short Explanation
The correct answer is D. Key Vault plus managed identities with least privilege, plus automated rotation, is the Azure pattern for multi-agent secrets. Baking keys into images forces rebuilds and spreads copies. Fancy Dockerfile encryption is still shipping secrets in artifacts. Email paste and Git branches are operational and security anti-patterns.
Full Explanation
Option D is correct. Multi-agent security skills specify Azure Key Vault for secrets, certificates, key rotation, RBAC to secrets, and encryption. Runtime retrieval by per-agent identities avoids baking secrets into images and enables rotation without redeploying code artifacts.
Option A is incorrect because encrypting Dockerfiles does not provide centralized rotation, auditing, or proper secret lifecycle, and images still carry sensitive material.
Option B is incorrect because manual email distribution is error-prone, unauditable, and slow, and encourages secret sprawl.
Option C is incorrect because source control is not a secrets manager; even private branches risk leakage through clones, forks, and CI logs.