Securely Access Script Secrets in Azure Key Vault

Securely Access Script Secrets in Azure Key Vault

Pluralsight Hands-On Lab — Security

---

At a Glance

Platform	Pluralsight
Category	Azure Security
Lab Type	Guided + Challenge Mode
Environment	Azure Portal, Windows VM via Remote Desktop, PowerShell
Completed	2026

---

Overview

Hard-coding secrets in plain text inside scripts is a common and critical security risk. In this lab, I was given a scenario as a security engineer tasked with securing an automation VM whose PowerShell scripts contained hard-coded secrets. I replaced that approach by configuring Azure Key Vault with a private endpoint to keep traffic off the public internet, attaching a user-assigned managed identity to the VM for native Entra ID authentication, and using PowerShell inside the VM to create and retrieve secrets from Key Vault — all without storing credentials in the script itself.

---

What I Did

• Reviewed the pre-configured managed identity and confirmed it held the Key Vault Secrets Officer role via Azure role assignments
• Attached the user-assigned managed identity to vm1 through the Identity blade under User assigned
• Created an Azure Key Vault with public access disabled and RBAC as the permission model
• Created a private endpoint for the Key Vault scoped to the existing virtual network and subnet, ensuring all Key Vault traffic remains private
• Connected to vm1 via Remote Desktop and opened PowerShell as Administrator
• Authenticated to Azure using the managed identity: Connect-AzAccount -Identity
• Captured a secret as a secure string, stored it in Key Vault using Set-AzKeyVaultSecret, and retrieved it in plain text using Get-AzKeyVaultSecret -AsPlainText to confirm end-to-end functionality

---

← Back to Pluralsight Labs