You can use a template that allows you to deploy a simple Windows VM by retrieving the password that is stored in a Key Vault. Therefore, the password is never put in plain text in the template parameter file. Reference: https://azure.microsoft.com/en-us/resources/templates/101-vm-secure-password/