MCP tool connectors need API keys and certificates. Developers currently paste secrets into container environment variables at build time and rebuild to rotate. What secrets-management approach should you design for multi-agent Azure deployments?
Select an answer to reveal the explanation.
Short Explanation
Answer B. Secrets management for multi-agent solutions uses Azure Key Vault: secrets, certificates, rotation, RBAC to secrets, and encryption. Agents retrieve at runtime via managed identity. Build-time baked secrets slow rotation and leak via images. Public blobs and verbose secret logging are unacceptable.
Full Explanation
Correct answer: B. Design Key Vault-centered secret retrieval for tools and model credentials. Grant each agent identity only the secrets it needs; enable rotation; avoid putting secrets in prompts, repos, or immutable images.
A is incorrect: image-baked secrets couple rotation to redeploy and widen leakage paths.
C is incorrect: public storage is not a secret store.
D is incorrect: traces must redact credentials even when prompt tracing is enabled.
Combine with network restrictions on Key Vault where required by policy.