diff --git a/deploy/aro/identity-api/azure-pipelines.yml b/deploy/aro/identity-api/azure-pipelines.yml
index cf31eace1..370f09b1a 100644
--- a/deploy/aro/identity-api/azure-pipelines.yml
+++ b/deploy/aro/identity-api/azure-pipelines.yml
@@ -24,6 +24,16 @@ stages:
         pool: 
           vmImage: 'windows-latest'
         steps:
+        - task: AzureKeyVault@1
+          displayName: 'Azure Key Vault: openshift-demo-vault'
+          inputs:
+            azureSubscription: 'Azure OpenShift Demo'
+            KeyVaultName: 'openshift-demo-vault'
+        - task: colinsalmcorner.colinsalmcorner-buildtasks.replace-tokens-task.ReplaceTokens@1
+          displayName: 'Replace tokens in identity-public-route'
+          inputs:
+            sourcePath: ./deploy/aro/identity-api
+            filePattern: identity-public-route.json
         - task: redhat.openshift-vsts.oc-setup-task.oc-setup@2
           displayName: 'Setup Openshift CLI'
           inputs:
@@ -33,4 +43,7 @@ stages:
           displayName: 'Set OpenShift Project Context'
         - script: 'oc process -f ./deploy/aro/openshift-templates/identityapi-deploy-template.yml -p IMAGE_REGISTRY_PROJECT_NAME=$(SourceImageRegistryProjectName) -p WEB_SPA_URL=$(WebSpaUrl) -p WEB_MVC_URL=$(WebMvcUrl) -p LOCATION_API_URL=$(LocationsApiUrl) -p MARKETING_API_URL=$(MarketingApiUrl) -p BASKET_API_URL=$(BasketApiUrl) -p ORDERING_API_URL=$(OrderingApiUrl) -p MOBILE_SHOPPING_AGGREGATOR_URL=$(MobileShoppingAggregatorUrl) -p WEB_SHOPPING_AGGREGATOR_URL=$(WebShoppingAggregatorUrl) -p WEBHOOKS_API_URL=$(WebhooksApiUrl) -p WEBHOOKS_WEB_CLIENT_URL=$(WebhooksWebClientUrl) | oc apply -f-'
           failOnStderr: true
-          displayName: 'Ensure Identity API OpenShift DeploymentConfig and Service'
\ No newline at end of file
+          displayName: 'Ensure Identity API OpenShift DeploymentConfig and Service'
+        - script: 'oc apply -f ./deploy/aro/identity-api/identity-public-route.json'
+          failOnStderr: true
+          displayName: 'Ensure Identity API Route'
\ No newline at end of file
diff --git a/deploy/aro/identity-api/identity-public-route.json b/deploy/aro/identity-api/identity-public-route.json
new file mode 100644
index 000000000..fc296674b
--- /dev/null
+++ b/deploy/aro/identity-api/identity-public-route.json
@@ -0,0 +1,26 @@
+{
+	"apiVersion": "route.openshift.io/v1",
+	"kind": "Route",
+	"metadata": {
+		"labels": {
+			"app": "identityapi"
+		},
+		"name": "identity-public-route"
+	},
+	"spec": {
+		"host": "__IdentityPublicHostName__",
+        "port": {
+            "targetPort": "8080-tcp"
+        },
+		"to": {
+			"kind": "Service",
+			"name": "identityapi"
+		},
+        "tls": {
+        "termination": "edge",
+        "key": "__PrivateKey3__",
+        "certificate": "__Certificate3__",
+        "caCertificate": "__CaCertificate3__"
+        }
+    }
+}
\ No newline at end of file
diff --git a/deploy/aro/web-mvc/webmvc-public-route.json b/deploy/aro/web-mvc/webmvc-public-route.json
new file mode 100644
index 000000000..d12826df9
--- /dev/null
+++ b/deploy/aro/web-mvc/webmvc-public-route.json
@@ -0,0 +1,26 @@
+{
+	"apiVersion": "route.openshift.io/v1",
+	"kind": "Route",
+	"metadata": {
+		"labels": {
+			"app": "webmvc"
+		},
+		"name": "webmvc-public-route"
+	},
+	"spec": {
+		"host": "__PublicHostName__",
+        "port": {
+            "targetPort": "8080-tcp"
+        },
+		"to": {
+			"kind": "Service",
+			"name": "webmvc"
+		},
+        "tls": {
+        "termination": "edge",
+        "key": "__PrivateKey3__",
+        "certificate": "__Certificate3__",
+        "caCertificate": "__CaCertificate3__"
+        }
+    }
+}
\ No newline at end of file