title: Can Azure Key Vault be used with Functions to store the connection string for queue triggers?
body: <p>I was able to use the Key Vault inside a function app <a href="https://docs.microsoft.com/en-gb/azure/app-service/app-service-key-vault-references" rel="nofollow noreferrer">as described here</a> but when I tried to use the Key Vault to hold the connection string of a function with a queue trigger I have issues with the storage account connection string. The function seems to find the parameter I provide but either doesn't get the secret back or doesn't like the information when it throws the error <code>No valid combination of account information found</code>. </p>
  
  <p>My function is defined as:</p>
  
  <pre><code>        [FunctionName("ReadQueueForMessage")]
          public static async Task Run([QueueTrigger("%AzureQueueTrigger%", Connection = "AzureWebJobsStorage")] string myQueueItem,
              Binder binderinputblob,
              ILogger log)
  </code></pre>
  
  <p>This works fine if I just define the connection string in my <code>local.settings.json</code>. What I'm trying to do is instead of just putting the connection string in the json file, I want to point the function to the Key Vault with this syntax:</p>
  
  <pre><code>"AzureWebJobsStorage": "@Microsoft.KeyVault(SecretUri=https://myappkeyvault.vault.azure.net/secrets/myapp-AzureWebJobsStorage-Queue/the-guid-of-secret)",
  </code></pre>
  
  <p>I did go to the Key Vault and update the access policies to include the function app so it can read/list the secrets. The documentation <a href="https://azure.microsoft.com/en-us/blog/simplifying-security-for-serverless-and-web-apps-with-azure-functions-and-app-service/" rel="nofollow noreferrer">here</a> shows making an update to the configuration after it was deployed to Azure. I'm trying to test first in Visual Studio. Maybe that is the issue? Or is it not possible at all to use the secret in this manner?</p>