Domain 4 of 4 · Chapter 2 of 4

Store and retrieve settings with Azure App Configuration

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Developing AI Cloud Solutions on Azure premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • What the store holds, and what decides how a value is read
  • Labels: one key name, a different value per environment
  • The provider is not the SDK client
  • Key Vault references: the store holds a pointer, your app makes the call
  • Refresh: the provider polls, and something has to trigger the poll
  • Feature flags: stored like a key-value, read like nothing else
  • Feature filters: on, but only when a condition holds
  • Snapshots: a named, immutable composition
  • Archive, recover, expire: the snapshot lifecycle
  • Point-in-time restore: revision history is a different mechanism
  • Telling the scenarios apart

The kinds of key-value, and what turns each one into a usable value

Kind of key-valueContent typeWhat the value holdsWho resolves itWhat a refresh does
Plain settingempty (treated as a string)The literal stringNobody; the provider hands it over as-isReloads it if the change is detected
JSON key-value`application/json` or any `application/…+json` media typeA JSON document, object or primitiveThe provider deserializes it into a Python objectReloads and re-deserializes it
Key Vault reference`application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8`The secret identifier (URI), never the secretThe provider, by calling Key Vault with a credential you supplyRe-reads the secret only on `secret_refresh_interval`, since the URI itself rarely changes
Feature flag`application/vnd.microsoft.appconfig.ff+json;charset=utf-8`The flag's JSON: `id`, `enabled`, `conditions`The provider loads it; `FeatureManager.is_enabled` evaluates itRe-reads every loaded flag, but only if `feature_flag_refresh_enabled=True`
Snapshot reference`application/json; profile="https://azconfig.io/mime-profiles/snapshot-ref"; charset=utf-8`A JSON object naming a snapshotThe provider, by loading that snapshot's key-valuesRepoints the app at a different snapshot when the reference changes

Decision tree

Is the value itself a secret?Key Vault referenceApp Configuration stores only the URIyour app reads the secret from the vaultYesNoIs it a feature toggle?Feature flagload with feature_flag_enabled=Trueevaluate with FeatureManager.is_enabledYesNoMust the value differper environment?Label on one keythe key name stays the same everywherestack selectors: the last one winsYesNoMust a running process pickthe change up, with no restart?Watch key, the sentinel key patternrefresh_on=[WatchKey("sentinel")]call config.refresh() where activity happensYesNoFreeze a release,or revert the store?Snapshotpin it by name, or point a snapshotreference at it to repoint at runtimefreeze a releasePoint-in-time restorewrites past revisions back to the live storeportal is selective; CLI without --key is notrevert the storeneitherPlain or JSON key-valueno content type, or application/json
Cheat sheet

Cheat sheet

  • Labels let one key hold a distinct value per environment
  • A key-value is uniquely identified by the key plus its label
  • A Key Vault reference stores the secret's URI, marked by a special content type; the secret stays in Key Vault
  • The application/json content type lets the provider parse a value as structured data
  • Feature flags are special key-values that toggle features without a redeploy
  • Feature filters conditionally enable a flag
  • Python resolves a flag through FeatureManager.is_enabled() over an opt-in load
  • Flags carry their own refresh switch and need no watch key
  • A sentinel key lets the provider reload all settings only when that one key changes
  • The provider caches configuration and refreshes on a cache-expiration interval
  • A snapshot is an immutable, named set of key-values for consistent deployment and rollback
  • Point-in-time queries recover an earlier key-value state from revision history
  • A Python app pins a release by naming the snapshot in the provider's selects argument
  • Archiving starts an expiration countdown that recovery has to beat

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. Understand Azure App Configuration key-value store
  2. Azure App Configuration best practices
  3. Python configuration provider for Azure App Configuration
  4. Use JSON content-type for key-values in Azure App Configuration
  5. Access Azure App Configuration using Microsoft Entra ID
  6. Azure App Configuration support for configuration files
  7. Tutorial: use Key Vault references in an ASP.NET Core app
  8. Azure App Configuration Python provider client library README
  9. Tutorial: use dynamic configuration in an ASP.NET Core app
  10. Use dynamic configuration in Python
  11. Use Azure App Configuration to manage feature flags
  12. Understand feature management using Azure App Configuration
  13. azure.appconfiguration.provider package reference
  14. Python feature flag management
  15. Snapshots in Azure App Configuration
  16. How to manage and use snapshots in Azure App Configuration
  17. Snapshot references in Azure App Configuration
  18. Retrieve key-values from a point-in-time