Which Azure service securely stores secrets (API keys, connection strings) and restricts access to authorized applications?

Azure Key Vault is the correct service because it is specifically designed to securely store and manage sensitive information like API keys, connection strings, certificates, and other secrets. It provides centralized storage, fine-grained access control (using Azure Active Directory), and audit logging, ensuring that only authorized applications and users can access these secrets. Azure Defender focuses on threat protection and security posture management, not secret storage. Azure App Service is a platform for hosting web applications and APIs, not for secret management. Azure Policy helps enforce organizational standards and assess compliance, rather than storing secrets.