Configuration & Deployment
App Configuration · Key Vault refs · IaC · Deployment Stacks
Practice questions for this topic →
Configuration
| Service | Stores | Notes |
|---|---|---|
| App Configuration | Settings + feature flags | Hierarchical namespaces, labels, queries, batch retrieval, feature-management UI, snapshots; Key Vault references |
| Key Vault | Secrets, keys, certificates | Hardware-level encryption, granular access control, certificate rotation; the right place for secrets |
| App Service app settings | Per-app settings | Fine for one app; not centralized |
Deployment
| Tool | Use for |
|---|---|
| Bicep / ARM | Declarative, repeatable infrastructure as code |
| Template Specs | Store and version templates in Azure; share with RBAC (optional with stacks) |
| Deployment Stacks | Manage deployed resources as one unit; deny settings (DenySettingsMode) block unwanted changes or deletes |
| GitHub Actions / Azure Pipelines | CI/CD, authenticating with workload identity federation (OIDC), no stored secret |
| Azure Blueprints (Preview) | Retiring: see the phases below |
Azure Blueprints retirement phases
| Date | What changes |
|---|---|
| Jul 31, 2026 | New blueprint definitions and versions can no longer be created |
| Oct 31, 2026 | Existing definitions can't be modified; new assignments can't be created |
| Dec 31, 2026 | Existing assignments can't be modified |
| Jan 31, 2027 | Retired: API stops responding; unexported definitions and assignments are deleted; blueprint locks stop working. Resources already deployed remain |
Migration: export definitions, convert them to Bicep or ARM, and deploy as Deployment Stacks. Roles, policies and templates become template content; locks become deny settings.
Exam Tips
Tick each tip once you can answer it without looking.
“Central settings shared by many apps + feature flags” → Azure App Configuration.
“App needs a database password” → Key Vault (referenced from App Configuration). Trap: Don't store secrets as plain App Configuration values.
“Turn a feature on/off at runtime without redeploying” → App Configuration feature flags.
“Same keys, different values for dev/test/prod” → App Configuration labels.
“Share approved, versioned templates across teams with RBAC” → Template Specs.
“Deploy a landing zone as one unit and block changes or deletion” → Deployment Stacks with deny settings. Trap: Azure Blueprints is retiring.
“Pipeline must deploy to Azure without storing a secret” → Workload identity federation (OIDC) for GitHub Actions / Azure Pipelines.
“Blue-green release on App Service” → Deployment slots + swap.
“Create a new Azure Blueprint assignment after October 31, 2026” → Blocked: use Deployment Stacks (new definitions were blocked from Jul 31, 2026). Trap: Existing assignments can't be modified from Dec 31, 2026.
“What happens to resources when Azure Blueprints retires on Jan 31, 2027” → Deployed resources remain; unexported definitions and assignments are deleted and blueprint locks stop working. Trap: Export what you need before the retirement date.
“Are Template Specs required to use Deployment Stacks” → No: stacks accept ARM or Bicep files, and template specs are optional for versioning and sharing. Trap: Deny settings (DenySettingsMode) replace Blueprint locks.
“Where do application secrets belong when using App Configuration” → Key Vault (hardware-level encryption, rotation); App Configuration holds key vault references. Trap: App Configuration adds labels, hierarchical keys, queries and a feature-management UI.
“Azure Blueprints retirement phases in order” → Jul 31, 2026 no new definitions; Oct 31, 2026 no definition edits and no new assignments; Dec 31, 2026 no assignment edits; Jan 31, 2027 retired. Trap: Unexported definitions and assignments are deleted and blueprint locks stop working.