Can be stored either in Databricks backed “Secret Scope” or in Azure key-vaults. Key-vault is the recommended option.
To add a Secret Scope to databricks you need to go to this hidden interface: