From 47d6dd102c0ab5365171dcfc2aa671c906435f66 Mon Sep 17 00:00:00 2001
From: Eric Erhardt <eric.erhardt@microsoft.com>
Date: Wed, 5 Jun 2024 10:25:01 -0500
Subject: [PATCH] Update KeyVault usage documentation

The current documentation is out of date. Updating to match current APIs and behavior.
---
 .../azure-security-key-vault-component.md     | 24 +++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/docs/security/azure-security-key-vault-component.md b/docs/security/azure-security-key-vault-component.md
index fa8f019f17..1dd6f04307 100644
--- a/docs/security/azure-security-key-vault-component.md
+++ b/docs/security/azure-security-key-vault-component.md
@@ -32,10 +32,30 @@ For more information, see [dotnet add package](/dotnet/core/tools/dotnet-add-pac
 
 ## Example usage
 
-In the _:::no-loc text="Program.cs":::_ file of your component-consuming project, call the <xref:Microsoft.Extensions.Hosting.AspireKeyVaultExtensions.AddAzureKeyVaultSecrets%2A> extension to register a `SecretClient` for use via the dependency injection container.
+### Add secrets to configuration
+
+In the _:::no-loc text="Program.cs":::_ file of your component-consuming project, call the <xref:Microsoft.Extensions.Hosting.AspireKeyVaultExtensions.AddAzureKeyVaultSecrets%2A> extension to add the secrets in the Azure Key Vault to the application's Configuration. The method takes a connection name parameter.
+
+```csharp
+builder.Configuration.AddAzureKeyVaultSecrets("secrets");
+```
+
+You can then retrieve a secret through normal <xref:Microsoft.Extensions.Configuration.IConfiguration> APIs. For example, to retrieve a secret from a service:
+
+```csharp
+public class ExampleService(IConfiguration configuration)
+{
+    string secretValue = configuration["secretKey"];
+    // Use secretValue ...
+}
+```
+
+### Use SecretClient
+
+Alternatively, you can use a `SecretClient` to retrieve the secrets on demand. In the _:::no-loc text="Program.cs":::_ file of your component-consuming project, call the <xref:Microsoft.Extensions.Hosting.AspireKeyVaultExtensions.AddAzureKeyVaultClient%2A> extension to register a `SecretClient` for use via the dependency injection container.
 
 ```csharp
-builder.AddAzureKeyVaultSecrets("secrets");
+builder.AddAzureKeyVaultClient("secrets");
 ```
 
 You can then retrieve the <xref:Azure.Security.KeyVault.Secrets.SecretClient> instance using dependency injection. For example, to retrieve the client from a service: