Another way to ensure that data is stored in an encrypted format and is only decrypted on a virtual machine is to use protectedSettings along with a Custom Script Extension. This object takes three properties. The configuration of the CommandToExecute property is similar to previous configurations; its purpose is to execute PowerShell scripts.
The storage account name is where we'll find the PowerShell script stored, and the storage account key will provide the account's access key. This information can be found within the Access keys menu item on Azure Portal, as shown in the following screenshot:
When using protected settings, the storage key is provided as its configuration. There is no need to append the SAS token to the URL. The new configuration of the resource is shown in the following snippet. Note that the complete code listing for this...