I have some secrets stored in azure keyvault.

Using the following code, I was able to get the secret values via a console application.

using System.Management.Automation;

 Collection<PSObject> result = PowerShell.Create().AddScript("az keyvault secret show --name 'yyyyy' --vault-name 'zzzz' --query 'value'").Invoke();

when I deploy the same to Sitecore site(by adding to the class library), I see it never gets the result, it's always empty.

Tested this both in the local Sitecore site( by adding clienID, client secret, tenantId) to environment variables and also in the azure app by enabling managed identity.

Any thoughts on what needs to be done to make this work in sitecore site?

  • Can you provide more detail about what problem you are trying to solve that led you to this scenario? Feb 12, 2022 at 4:10
  • @MichaelWest as I said, I was unable to access Azure Key Vault secret via Sitecore site, whereas I am able to access Azure Key Vault secret while debugging in a console app. Just wondering if there is any special settings to be made in sitecore website to make this work?
    – sns
    Feb 12, 2022 at 4:16
  • I see now. After reading the question another time or two 🕑 t makes sense. You can connect with a console app but not from Sitecore. Perhaps the Sitecore app pool doesn't have access to the utility or requires a user profile to function. Feb 12, 2022 at 4:39
  • @MichaelWest I'm glad you got my question :), In the windows machine that access is provided by adding (clienID, clientsecret, tenantId) to the environment variables, whereas in the azure app(paas), the access is provided via managed identity, tested in both environments by providing the respective access, but there is no luck for Sitecore site.
    – sns
    Feb 12, 2022 at 4:48
  • 1
    This is not a Sitecore question and I’ve reread several times and I still don’t understand your use case. Sitecore in Azure runs as a web app. Give you web app read access to the secrets of your vault. Then add an app setting referencing your secret. Then read the app setting like any normal app. What I described is the most common use of secrets. Regardless, as I said I don’t see how Sitecore factors into what you’re trying to do.
    – jrap
    Feb 13, 2022 at 17:19

2 Answers 2


you should give Sitecore webapp the access to your keyvault. We have ours in the same Resource Group too. I used the following code sample from Github (hopefully this will help some).


Better solution: Leverage the Azure functions to get the keyvault value from your app service. This is how we are implementing it now. Gives us a reuseable function that many other app can use.


Try this one.

using Azure;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets; 

var secretClient = new SecretClient(new Uri("<URL of Key Vault>"), new DefaultAzureCredential());
Response<KeyVaultSecret> secret = await secretClient.GetSecretAsync("Key vault key");
var keyValue = secret.Value;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.