Securing a Mobile App on Azure
A mobile app secured end to end on Azure: the key that should never ship, the layers between app and database, and what happens when you tap Sign in.
8 parts · about 34 minutes end to end · updated October 9, 2026
Most mobile security advice stops at “don’t hardcode secrets” and never explains the day you have to undo it. This series takes one real shape — a phone, an API, and Azure behind it — and walks it door by door: the key that is already public the moment you ship it, the five layers that stand between the app and the database, what a security scan actually finds on a working app, Key Vault and managed identity done properly, an automated attacker running at 3am, and the full journey of a single sign-in from tap to token.
Read it in order
- 1 The Secret in Your APK: Why Obfuscation Will Not Save It
An APK or IPA is a zip file. Anything hardcoded inside it, including your API key, is already public — and here is how to get it off the phone for good.
September 26, 2026 · 5 min read views
- 2 How Azure Protects a Mobile App: The Full Request Flow, Layer by Layer
Front Door, your API, Microsoft Entra ID, authorization and a private database — the five layers that stand between a mobile app and its data on Azure.
September 25, 2026 · 7 min read views
- 3 Hardcoded API Key Blast Radius: What Happens When a Mobile Key Leaks
The attacker costs you hours. Rotating a key baked into 40,000 installed apps costs you days, and that gap is the real price of a hardcoded secret.
October 2, 2026 · 4 min read views
- 4 Hacker vs Azure Defences: Five Attacks on a Mobile Backend, Five Controls
Five common attacks on one Azure mobile backend and the control that stops each: WAF, Entra ID, an owner check, Key Vault and a private endpoint.
October 3, 2026 · 4 min read views
- 5 Five Mobile App Security Vulnerabilities a Scan Finds, and Which to Fix First
Five findings on a working mobile app, none deliberate: a secret in the package, a token in plain storage, an open endpoint, TLS off, extra permissions.
October 4, 2026 · 4 min read views
- 6 How to Secure a Mobile API on Azure in Five Steps, in the Right Order
HTTPS only, authentication, authorization, secrets and monitoring: five steps to secure a mobile API on Azure, and why the order carries most of the value.
October 5, 2026 · 4 min read views
- 7 Azure Key Vault Explained: The One Secret Tutorials Never Remove
Moving every secret into Key Vault leaves exactly one behind: the credential that opens the vault. A managed identity is what removes it.
October 7, 2026 · 5 min read views
- 8 AI Bot Attacks on a Mobile App Login, and How Azure Stops Them
A script tries 8,000 passwords a minute against your login API at 3am. Rate limiting, smart lockout and Defender for Cloud make speed the losing move.
October 9, 2026 · 4 min read views
Get new posts by email
New technical articles, Azure AI and GitHub Copilot updates, and upcoming events. No spam, unsubscribe anytime.