Manage Azure App Configuration with TypeScript

Wraps three Azure App Configuration packages for TypeScript: the low-level CRUD SDK (@azure/app-configuration) for management operations, the high-level runtime provider (@azure/app-configuration-provider) recommended for applications, and @microsoft/feature-management for evaluating feature flags with targeting. Authentication is via DefaultAzureCredential (recommended) or a connection string, reading AZURE_APPCONFIG_ENDPOINT/AZURE_APPCONFIG_CONNECTION_STRING.

import { AppConfigurationClient } from "@azure/app-configuration";
import { DefaultAzureCredential } from "@azure/identity";

// DefaultAzureCredential (recommended)
const client = new AppConfigurationClient(
  process.env.AZURE_APPCONFIG_ENDPOINT!,
  new DefaultAzureCredential()
);

The low-level client covers full CRUD: addConfigurationSetting (fails if the key exists), setConfigurationSetting (create-or-update, with onlyIfUnchanged optimistic concurrency), getConfigurationSetting (optionally by label), listConfigurationSettings with key/label filters (including a null-label filter and listing available labels), deleteConfigurationSetting, and setReadOnly to lock/unlock a setting.

The high-level provider's load() builds a runtime configuration object from selectors (key/label filters or a named snapshot), with map-style (appConfig.get(...)) and object-style (constructConfigurationObject({ separator })) access, key-prefix trimming, dynamic refresh (refreshOptions.enabled/refreshIntervalInMs, a manual refresh() call, an onRefresh() listener, and an Express-middleware refresh pattern), and Key Vault references resolved automatically via keyVaultOptions with their own secret refresh interval.

Feature flags can be created at the low level with featureFlagPrefix/featureFlagContentType and a FeatureFlagValue including Microsoft.Targeting client filters (per-user, per-group with a rollout percentage, and a default rollout percentage), or loaded via the provider's featureFlagOptions and evaluated with FeatureManager.isEnabled(name), optionally passing a targeting context (userId, groups). Snapshots are created with beginCreateSnapshotAndWait (name, retention period, filters), retrieved with getSnapshot, listed via listConfigurationSettingsForSnapshot, archived and recovered, and can be loaded directly by the provider via a snapshotName selector.

Use it for centralized configuration management, feature-flag evaluation, or dynamic configuration refresh in a TypeScript/Node application backed by Azure App Configuration. As with any skill output, verify results against the current environment, and stop to ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Input is an App Configuration endpoint or connection string, an Entra ID credential, and setting keys/labels/filters or feature-flag definitions. Output is a created, updated, or deleted configuration setting or feature flag, a runtime configuration object with live refresh, resolved Key Vault secret values, or a named point-in-time snapshot.

Uses @azure/app-configuration for CRUD, @azure/app-configuration-provider for the runtime provider with dynamic refresh and Key Vault reference resolution, @microsoft/feature-management for feature-flag evaluation with targeting, and @azure/identity for authentication; stated best practices recommend the provider for app runtime config, the low-level SDK for management tooling, labels for environment separation, snapshots for immutable release configs, a sentinel key to trigger full refresh, and the App Configuration Data Reader RBAC role for read-only access.

TypeScript/Node developers centralizing application configuration and feature flags on Azure who need live-refreshing runtime config, Key Vault-backed secrets, and evaluated feature flags with targeting.