from azure.appconfiguration import AzureAppConfigurationClient
from azure.keyvault.secrets import SecretClient
from azure.identity import AzureCliCredential

import json


credential = AzureCliCredential()
config_client = AzureAppConfigurationClient(base_url= APP_CONFIG_URL, credential=credential)
secret_client = SecretClient(vault_url=KEY_VAULT_URL, credential=credential)

app_config = dict()

for namespace in NAMESPACE_FILTER.split(','):
    for config in config_client.list_configuration_settings(key_filter=f'/{namespace}/*', label_filter=LABEL_FILTER):
         if config.content_type == 'application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8':
             app_config[config.key.split('/')[-1]] = secret_client.get_secret(json.loads(config.value)['uri'].split('/')[-1]).value
         else:
             app_config[config.key.split('/')[-1]] = config.value

{
  'additional_properties': {},
  'key': <key>, 
  'label': <label>, 
  'content_type': 'application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8', 
  'value': '{"uri":<keyvault_uri>}', 
  'last_modified': <last_modified>, 
  'tags': {}, 
  'read_only': False, 
  'etag': <etag>'
}

{
  'key': <key>, 
  'label': <label>, 
  'content_type': 'application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8', 
  'etag': <etag>, 
  'last_modified': <last_modified>, 
  'read_only': False, 
  'tags': {}, 
  'secret_id': None, 
  '_value': '{"secret_uri": null}'
}