Q: How do you ensure secure and dynamic secret rotation in Azure DevOps pipelines?

Configure Azure DevOps Service Connections with Workload Identity Federation instead of static client secrets. When a pipeline runs, Azure DevOps generates a short-lived cryptographically signed OIDC token that Azure Active Directory exchanges for a temporary, 1-hour Azure access token.

# Azure DevOps YAML using federated service connection
steps:
- task: AzureCLI@2
  inputs:
    azureSubscription: 'Azure-DevOps-WorkloadIdentity-ServiceConnection'
    scriptType: 'bash'
    scriptLocation: 'inlineScript'
    inlineScript: |
      az account show

Never store application database credentials in pipeline YAML. Use the `AzureKeyVault@2` pipeline task to dynamically pull the latest active secret version directly into agent memory at execution time. Secrets are masked in logs automatically.

- task: AzureKeyVault@2
  inputs:
    azureSubscription: 'Azure-DevOps-WorkloadIdentity-ServiceConnection'
    KeyVaultName: 'kv-prod-banking'
    SecretsFilter: 'DB-PASSWORD,STRIPE-SECRET'
    RunAsPreJob: true

Configure Azure Key Vault automatic rotation policies. When a database password reaches its 30-day lifecycle expiration, Key Vault triggers an Azure Event Grid event to an Azure Function, which generates a new password, updates PostgreSQL/SQL Server, and stores the new secret version in Key Vault with zero downtime.

During rotation, configure the database with two active users (User A and User B). When User A's password rotates, services gracefully transition to User B without connection drops before User A's credentials are wiped.