Access Key Vault from Azure DevOps Pipeline (YAML & Classic)

When setting up deployment pipelines in Azure DevOps, sometimes you need to get secret information stored in Azure Key Vault. This article describes how to access Key Vault from your Azure DevOps Pipelines. It’s all about keeping sensitive data safe and making your deployment process smooth and reliable. Let’s dive in!

Pre-requisites:
1. Azure DevOps project and a key vault.
2. Permission to access Microsoft Entra ID applications.

What is Azure DevOps project service principal?

To know the service principle (entra application ID) associated with Azure DevOps project

1. navigate to ‘Project Settings’ – > ‘Service connections’.

2. Open any service connection and click on the ‘Manage Service Principal’ link as shown in the image below.

3. This will open the Microsoft Entra ID application associated with the DevOps project in Azure portal.

4. Note the Application (client) ID. This is the application ID to which we would need to grant access to Azure key vault.

Grant access to Azure DevOps application ID on Azure key vault

1. Navigate to the key vault in Azure portal that you want to access in Azure DevOps project pipelines.

2. Click on ‘Access policies’ on the left side navigation list and click ‘Create’ to create a new access policy.

3. Select the required permissions for the pipeline and Click ‘Next’.

4. Search for the application ID (from the previous section) and select the application.

5. Authorise the app to perform the specified permissions on the User’s or Group’s behalf.

6. ‘Review’ the steps and click ”Create’ to grant access to the DevOps project on Azure key vault.

Vault Access Policies vs Azure RBAC

The steps above use the key vault’s Access Policies permission model. Microsoft now recommends the Azure RBAC permission model for new key vaults, and some vaults are RBAC-only. If your vault uses Azure RBAC instead of Access Policies:

1. Navigate to the key vault → Access control (IAM).
2. Click Add role assignment.
3. Choose a role — typically Key Vault Secrets User for pipelines that
   only need to read secrets.
4. Under Members, select the Azure DevOps service principal
   (application ID) from the earlier step.
5. Click Review + assign.

Check which model your vault uses under Settings → Access configuration on the key vault before following either set of steps above.

Access the key vault secrets in Azure DevOps YAML pipeline

Once the access is set up, you can add a Azure Key Vault Task in your YAML pipeline to access key vault secrets.

          - task: AzureKeyVault@1
            inputs:
              azureSubscription: 'service-connection-name'
              KeyVaultName: 'key-vault-name'
              SecretsFilter: 'secret1,secret2'
              RunAsPreJob: true

Link a variable group to Key Vault (alternative to the Key Vault task

Instead of adding an AzureKeyVault@1 task to every pipeline, you can link an Azure DevOps variable group directly to a key vault. This exposes the secrets as pipeline variables across every pipeline that uses the group, without extra pipeline steps.

1. Go to Pipelines → Library in Azure DevOps and click + Variable group.
2. Toggle on Link secrets from an Azure key vault as variables.
3. Select your Azure subscription (service connection) and the key vault
   name.
4. Click Authorize, then select the secrets you want to expose.
5. Reference the variable group in your YAML pipeline:

variables:
- group: 'my-keyvault-variable-group'

This method is a good fit when the same secrets are shared across multiple pipelines, since you manage the link once instead of repeating the AzureKeyVault@1 task in every pipeline file.

Troubleshooting common Key Vault pipeline errors

“The user, group or application does not have secrets list permission on key vault”
The service principal has been granted the wrong permission, or access hasn’t propagated yet. Re-check that you selected Get and List under Secret permissions (Access Policies model) or the Key Vault
Secrets User role (RBAC model), and re-run the pipeline after a minute.

“Forbidden” or 403 from the AzureKeyVault@1 task
Usually means the service connection used in azureSubscription doesn’t match the service principal you granted access to. Confirm both point to the same Entra ID application ID.

Secrets not appearing as pipeline variables
SecretsFilter must exactly match the secret names in the vault (case-sensitive), and RunAsPreJob: true is required if you need the secrets available before the job’s other tasks run.

Pro tips:
1. Learn how to access Key Vault secrets in Azure Data Factory.

See more

Kunal Rathi

With over 15 years of experience in data engineering and analytics, I've assisted countless clients in gaining valuable insights from their data. As a dedicated supporter of Data, Cloud and DevOps, I'm excited to connect with individuals who share my passion for this field. If my work resonates with you, we can talk and collaborate.