Allow Environment or Label specific permission options
I am planning to store Development, Test, and Production configuration in a single App Configuration instance using Labels. Clients will access the configuration using Managed Identity and I want to restrict access to "Production" Label.
This Hot Topic Customer Survey allows all of its customers to share their recent shopping experience with Hot Topic store. The Hot Topic Customer Satisfaction Survey
<a href="http://online-surveys.info/">Hot Topic Survey</a>
Andy Mehalick commented
We do exactly this but via three separate instances of App Configuration so each environment has a unique connection string. There's value in separation for security reasons and management in some ways is actually easier.
Security around labels still seems like a good idea but at that point perhaps separate instances is even better.
Drago Draganov commented
For security reason separation in different AppConfiguration instances in preferable, because it allows to utilize VNET (work item in progress) and other security-in-depth practices.
We are working on improving our tools for cross-instance management to mitigate some of the inconvenience.