Azure App Configuration

Per-key configuration with one label per environment.

Connection

What	This provider
Vendor	Microsoft Azure
Key	`azure-app-configuration`
Availability	`available`. You can connect it today.
Credential we hold	`azure-service-principal`
Values read back	yes
Activation	`immediate`

Direction	What it does
`import`	We read names and values out of the store into your environment.
`export`	We write names and values from your environment into the store.

immediate. The running app sees a new value at once.

Direction	Policies you can pick
`import`	`skip_existing`, `new_version`, `fail`
`export`	`create_only`, `overwrite`, `overwrite_and_prune`

How syncs work says what each one does.

Paste a credential from the vendor. We seal it and never show it again.

Field	Label	Kind	Required
`tenantId`	Directory (tenant) ID	secret; we mask it here and seal it	yes
`clientId`	Application (client) ID	secret; we mask it here and seal it	yes
`clientSecret`	Client secret	secret; we mask it here and seal it	yes

You set these when you connect. Every mapping on the connection shares them.

Field	Label	Kind	Required	Advanced	What it is
`storeName`	Store	text	yes	no	The store's name alone. Its host is <name>.azconfig.io.

You answer these once per environment you map.

Field	Label	Kind	Required	Advanced	What it is
`label`	Label	text	yes	no	A sync owns one label. We leave keys under other labels alone.

We probe for these when we verify the connection.

Permission	Directions	Blocking	Without it
`appconfig:read`	every direction	yes	Preview cannot list what the store holds.
`appconfig:write`	`export`	yes	Export cannot write anything.