Azure DevOps Pipelines

For accessing/storing these kinds of secrets you can try the Azure Key Vault

Store all your secrets in Azure Key Vault secrets.

When you want to access secrets:

• Ensure the Azure service connection has at least Get and List permissions on the vault. You can set these permissions in the Azure
  portal:

  • Open the Settings blade for the vault, choose Access policies, then Add new.

  • In the Add access policy blade, choose Select principal and select the service principal for your client account.

  • In the Add access policy blade, choose Secret permissions and ensure that Get and List are checked (ticked).

  • Choose OK to save the changes.

Reference

You can use

1. Secure Azure DevOps Variables or Variable Groups
2. Azure Key Vault
3. If you use a Service Principal, then you need a password / certificate as well to authenticate. Maybe you can also try to work with MSI (Managed Service Identity). In that case, the AAD will take care of the secret storage.

If you don't want to store credentials on Azure Devops itself, best way is to store credentials in a credential store (Azure Key Vault) and access it through a service connection. I assume that you are using YAML based pipelines. If so use the following steps to integrate your pipeline with the key vault,

Prerequisites,

• Azure key vault is set up and keys are securely stored

Steps,

1. In edit mode of the pipeline click on the kebab menu (three dots on upper right corner) and select Triggers
2. On the opened menu click on the Variables tab and then Variable Groups
3. Open Manage variable groups in a new tab
4. Click on + Variable group button to add a new variable
5. Give a name and a description. Switch on the Link secrets from an Azure key vault as variables toggle.
6. Add a new service connection and once authenticated select the key vault name
7. Now add variables in to the variable group
8. Once done save the variable group and go back to the previous tab in step 2 and link the new variable group.
9. Once done save the pipeline

Important: You need to grant secret read permission to the service connection's service principal from your key vault.Reference: Link secrets from an Azure key vault