11.3 Azure App Configuration for App Settings

11.3 Azure App Configuration for App Settings

Quick Answer: Use Azure App Configuration to store and dynamically refresh non-secret app settings and feature flags. Organize variants with labels, refresh instances with a sentinel key pattern, and keep true secrets in Key Vault—optionally referenced from App Configuration.

Key Vault solves secret storage and retrieval. Most application configuration is not secret: model deployment names, feature toggles, retry counts, cache TTLs, regional endpoint URLs, and UI thresholds. Azure App Configuration is the Azure service purpose-built to store, version, label, and dynamically distribute those settings to App Service, Container Apps, AKS, VMs, and other hosts.

Why App Configuration Exists Alongside Key Vault

A common AI-200 architecture: App Configuration holds AzureOpenAI:DeploymentName, Rag:TopK, and feature flags like EnableStreaming, while Key Vault holds AzureOpenAI--ApiKey or a connection string. The app loads both: configuration provider for App Configuration, secret resolution for Key Vault.

Key-Values: The Core Data Model

App Configuration stores key-value pairs:

• Key — hierarchical string, often using : or / separators (App:Search:IndexName).
• Value — string content interpreted by the app (numbers, JSON, booleans as strings).
• Content type — optional metadata (for example, application/json).
• Label — optional variant dimension (discussed next).
• ETag / last modified — concurrency and refresh markers.

Applications typically map keys into the standard configuration hierarchy used by .NET IConfiguration, Java Spring, or equivalent, so existing GetValue<int>("Rag:TopK") code works after the App Configuration provider is added.

Access control uses Microsoft Entra ID. Grant application managed identities App Configuration Data Reader for read-only consumption and App Configuration Data Owner (or narrower custom roles) for writers/operators. Prefer managed identity over read keys when possible; access keys exist but increase secret sprawl.

Labels for Environments and Rings

Without labels, teams often create keys like Prod-TopK and Dev-TopK. Labels keep the key name stable and vary the value by dimension:

Clients select labels when loading configuration—for example, load Prod plus a private override label for a canary slot. This supports:

• Environment separation — Dev/Test/Prod values without separate stores for every team (though separate stores remain valid for hard isolation).
• Deployment rings — gradually move label targeting from canary to broad production.
• Tenant or region variants — when the same app binary serves multiple configuration profiles.

Exam tip: Labels are not a substitute for Key Vault RBAC. They organize settings; they do not encrypt secrets.

Feature Flags

App Configuration includes a feature flag model consumed by feature management libraries (.NET Feature Management, analogous patterns in other stacks). Flags support:

• Boolean on/off toggles (BetaChatUi).
• Percentage rollouts and targeting filters (users, groups, time windows)—exact filter availability depends on the library and flag definition.
• Central kill switches for risky AI behaviors (disable tool calling, disable web browsing plugin, force fallback model).

Operators flip flags in the App Configuration portal or via API without rebuilding images. For AI solutions, feature flags are ideal for progressive delivery of prompt versions, new retrieval pipelines, or UI experiences while keeping a fast rollback path.

Feature flags still belong in App Configuration rather than Key Vault because they are operational settings, not credentials—even when a flag gates access to a premium capability.

Dynamic Refresh

Static load-at-startup configuration forces redeploy or restart for every change. Dynamic refresh lets running instances pick up new key-values and flag states.

Typical .NET pattern:

1. Register the App Configuration provider with ConfigureRefresh watching one or more keys.
2. Use a sentinel key (for example, App:ConfigVersion) that operators increment after a batch of related changes.
3. The client polls on an interval; when the sentinel changes, it reloads the watched configuration set.
4. Middleware or a refresh service calls TryRefreshAsync so requests see updated values.

Dynamic refresh must be designed carefully for secrets referenced through App Configuration: refreshing may re-resolve Key Vault references, which is desirable after rotation but increases vault get traffic—cache thoughtfully.

Key Vault References Inside App Configuration

App Configuration can store a value that is a Key Vault reference, so non-secret and secret material appear in one configuration surface while the secret bytes remain in Key Vault. The application identity then needs:

1. Permission to read App Configuration key-values.
2. Permission to get the referenced Key Vault secret (Secrets User).

This hybrid model is popular on AI-200 architectures: one configuration bootstrap, clear separation of secret storage, and still central management of which secrets each environment uses.

Operational Practices for AI Apps

1. Separate stores or strict labels for production versus non-production to reduce blast radius of mistaken edits.
2. Soft delete / geo-replication options on the App Configuration store for resilience (match workload criticality).
3. Audit who changed flags—a flipped EnableCustomerDataLogging flag can be a compliance event.
4. Do not put passwords in plain App Configuration values; use Key Vault references or read secrets directly from Key Vault.
5. Combine with rotation: after Key Vault rotation, either rely on reference re-resolution during refresh or update the referenced version and bump the App Configuration sentinel so all instances reload.

End-to-End Secure Configuration Picture

For the AI-200 domain Implement secure Azure solutions, remember the split of responsibilities:

• Key Vault — secrets, keys, certificates; managed identity + RBAC; GetSecret / platform references; versioned rotation with dual validity.
• App Configuration — key-values, labels, feature flags, dynamic refresh; optional Key Vault references for secret-backed settings.

Together they keep AI applications configurable without redeploying for every operational change and without scattering credentials across app settings files, container images, and source repositories.