Encrypt Sitecore credentials by securing credentials under App services Configuration
This blog is intended to secure the connection strings of the Sitecore platform as per the recommendations from Sitecore. This is a very important step to secure the credentials, to stop them exposed to unauthorised access.
By default, the Sitecore passwords are stored in Connectionstrings.config for the different roles. As per the recommendations from Sitecore, they should be encrypted so that passwords are not exposed without authorization.
For the Core roles and XP Service roles, below is the method that you can use to secure the credentials of the website.
Step 1: For each of the roles, open App service Editor/Advanced Tools and navigate to the file "site/wwwroot/App_Config/ConnectionStrings.config"
Step 2: For each of the connection strings mentioned in the file ConnectionStrings.config, create a new entry under the App service -> Configuration -> scroll down to "Connection Strings" section. For example, core, web, master, security, etc. The name of the key will be the same as in the file. And the Value will be the complete "connectionString" value from the file. Type will be SQLAzure for the database ones.
For other connection strings, you can set them to Custom.
Step 3:
Make sure you empty the connectionString value from each of the line items on the file ConnectionStrings.config. App services will fetch the connection strings from the Connection Strings section of the Configuration automatically.

And for the webjobs in the roles, xConnect Search, Cortex Processing and Marketing Operations : Below is the method to move their credentials into Configuration under App services.
Step 1: For each of the webjobs mentioned above, open App service Editor/Advanced Tools and navigate to the file wwwroot\App_Data\jobs\continuous\xxx\App_Config where xxx is among the folders ProcessingEngine/IndexWorker/AutomationEngine depending on the webjob.
Step 2: Create an App setting by name "SITECORE_CONNECTIONSTRINGS_" as prefix followed by name from ConnectionStrings.config. Please make sure, name should be in Capital letters.
Step 3:
Make sure you empty the connectionString value from each of the line items on the file ConnectionStrings.config. App services will fetch the connection strings from the Connection Strings section of the Configuration automatically.