Secret Reference Failures¶

Use this query to identify failures caused by missing secrets, invalid secret references, or Key Vault access problems.

Data Source¶

Query Pipeline¶

flowchart LR
    A[Filter by app] --> B[Filter secret and Key Vault signals] --> C[Project reason and revision] --> D[Sort by time]

Query¶

let AppName = "my-container-app";
ContainerAppSystemLogs_CL
| where ContainerAppName_s == AppName
| where Log_s has_any ("secret", "secretRef", "KeyVault", "vault", "denied", "reference")
| project TimeGenerated, RevisionName_s, Reason_s, Log_s
| order by TimeGenerated desc

Example Output¶

Interpretation Notes¶

• Secret reference errors during provisioning often block revision activation.
• Vault-related denied errors usually point to identity permission scope.
• Normal pattern: no secret errors after stable rollout.

Limitations¶

• Error string wording may vary by platform updates.
• Must correlate with az containerapp secret list and identity checks.

See Also¶

• Managed Identity Token Errors
• Secret and Key Vault Reference Failure Playbook