title: Azure Configuration Settings More Secure than Web.Config?
body: <p>I'm using Azure Cloud Services, not Web Sites.</p>
  
  <p>I would like to know if storing sensitive data (passwords) in Azure Service Configuration Settings is secure.</p>
  
  <p>I really don't want to implement the 4-part blog series required to encrypt the web.config in Azure Web Roles, so I'm thinking I could just keep my settings in Azure config and then access them through <code>RoleEnvironment.GetConfigurationSettingValue()</code>.</p>
  
  <p>These settings are in a config file much like web.config, so my question is whether this config file is just used to build the cloud service and then discarded, or if it stays on disk during the life of the instance (thereby exposing sensitive data to attack).</p>
  
  <p>I like the ability to update these settings at runtime through the Portal and I consider the Portal a secure endpoint, so I'm OK with it.  However, if the file stays on disk then it is no more secure than the web.config file IMHO.</p>