How to keep secrets in Azure Functions?

While doing a code review of an Azure Function I noticed the following line:

var personalAccessToken = Environment.GetEnvironmentVariable("KeyVault_PersonalAccessToken", EnvironmentVariableTarget.Process);

Could it be that the developer directly stored a secret in an environment variable? Instead of using a secure storage like Azure Keyvault?

Inside the configuration on the Azure Portal I found the following:

@Microsoft.KeyVault(SecretUri=https://sample-vault.vault.azure.net/secrets/personal-access-token/<removedthekey>)

Luckily my assumption was wrong and it turns out that is a feature I wasn’t aware of in Azure (Functions).

To use this feature you first have to create a Managed Service Identity for your Azure Functions app as described here: https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=dotnet#creating-an-app-with-an-identity

Once you have a Managed Service Identity you can add an Access policy in your Azure Keyvault:

Now you can copy the secret identifier from the secret you want to use:

This secret identifier should be added with a special connectionstring to your Azure Function configuration:

 @Microsoft.KeyVault(SecretUri={theSecretUri}).

Thanks Dario for teaching me this trick!