Securing a Mobile App on Azure
A working mobile app secured end to end on Azure — the key that should never ship, the layers between the app and the database, and what actually happens when you tap Sign in.
2 parts · about 8 minutes end to end · updated August 18, 2026
Most mobile security advice stops at “don’t hardcode secrets” and never explains the day you have to undo it. This series takes one real shape — a phone, an API, and Azure behind it — and walks it door by door: the key that is already public the moment you ship it, the five layers that stand between the app and the database, what a security scan actually finds on a working app, Key Vault and managed identity done properly, an automated attacker running at 3am, and the full journey of a single sign-in from tap to token.
Read it in order
- 1 Your Mobile App Is Leaking Its API Key — and Obfuscation Will Not Save It
An APK or IPA is a zip file. Anything hardcoded inside it, including your API key, is already public — and here is how to get it off the phone for good.
August 16, 2026 · 4 min read
- 2 How Azure Protects a Mobile App: The Full Request Flow, Layer by Layer
Front Door, your API, Microsoft Entra ID, authorization and a private database — the five layers that stand between a mobile app and its data on Azure.
August 18, 2026 · 5 min read
Get new posts by email
New technical articles, Azure AI and GitHub Copilot updates, and upcoming events. No spam, unsubscribe anytime.