How to properly store connection strings in Azure?
<p>SQL azure connection strings always include a password (as Azure SQL Server doesn't support OS authentication) which makes it unsafe to keep them in <code>web.config</code> files. A typical recommendation you can find on the net is to move them to cloud configuration settings which means declaring a setting in <code>ServiceDefinition/WebRole/ConfigurationSettings</code> section of <code>ServiceDefinition.csdef</code> file so that you can edit them in the portal:</p>

<p><a href="https://i.stack.imgur.com/YNnSB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/YNnSB.png" alt="enter image description here"></a></p>

<p>The problem with this approach is whenever you re-deploy your site the settings you set in the portal get overriden with what values are in <code>ServiceConfiguration.*.cscfg</code>. Of course, you can put your connection strings to the file but that's pointless as you still keep the secrets in a source control.</p>

<p><a href="https://azure.microsoft.com/en-us/services/key-vault/" rel="nofollow noreferrer">Azure Key Vault</a> could be a good solution here but I'd like to explore other options before going this route. What would you recommend?</p>