logologo
AboutResumeProjectsField Notes

© 2026 Beretests. All rights reserved.

← Back to projects
Azure & Microsoft 365Professional case study

Professional project

Event-Driven Azure Key Vault Credential Rotation

Azure solutions engineer

Designed and implemented event-driven Azure Functions that rotate Microsoft Entra application secrets and synchronize new Key Vault certificate versions, with controlled credential overlap and timer-driven reconciliation for missed work.

Azure FunctionsPowerShellAzure Key VaultAzure Event GridMicrosoft GraphMicrosoft Entra IDManaged IdentityAzure Table StorageAzure PipelinesTeams Workflows
Read architecture field note
Confidentiality: This case study is based on work maintained in a private Azure DevOps repository. Tenant, vault, application, pipeline and organization identifiers—as well as source code and security-sensitive configuration—are not published.

What the work delivered

01

Automates credential rotation from Key Vault lifecycle events without embedding service credentials in the Function App

02

Keeps previous credentials available during a configurable overlap window before safe retirement

03

Adds locking, idempotency, audit state, reconciliation, dead-lettering, alerts and operational notifications

Goals

  • Reduce expiry risk and recurring manual credential handoffs
  • Process duplicate and retried Event Grid deliveries safely
  • Recover from missed events and partial failures without creating hidden credential drift
  • Deploy repeatably through Azure Pipelines with least-privilege managed identity access

Key design decisions

  • Used Event Grid as the primary trigger and a six-hour timer as an independent reconciliation path
  • Applied per-application locks and idempotency records in Table Storage
  • Separated credential activation from retirement through delayed overlap cleanup
  • Added a compensating Microsoft Graph removal when a newly created password cannot be written to Key Vault
  • Kept Teams notifications best effort so notification failures do not invalidate successful rotation work

Challenges and solutions

At-least-once event delivery

Combined a bounded idempotency window with expiring per-application locks so repeated and concurrent deliveries do not create duplicate credentials.

Cross-service partial failure

Implemented compensating cleanup when Graph creates a password but the Key Vault write fails, and recorded explicit run states for operator follow-up.

Missed rotation work

Built a capped timer-triggered reconciliation scan that detects expiring secrets, certificate drift and delayed cleanup, then routes the work through the same rotation handler.

Safe credential retirement

Kept old passwords and certificates during a configurable grace period and removed them only after a valid replacement was active.

Key learnings

  • Designing event-driven automation around duplicate and missed delivery
  • Using compensation and explicit state to manage distributed partial failure
  • Separating credential activation, adoption and retirement into safe operational stages
  • Treating audit, alerting and reconciliation as core architecture rather than add-ons