Azure Key Vault

About Azure Key Vault

Azure Key Vault is Microsoft's managed Azure service for protecting application secrets, cryptographic keys and certificates. It is designed to keep sensitive material out of source code, configuration files and unmanaged credential stores while giving teams centralized access control, auditing and lifecycle options. Key Vault includes Standard and Premium vault tiers, while Azure Managed HSM is a separate resource type for organizations that need dedicated HSM-backed key management. Buyers should choose the service based on what they need to protect, how applications authenticate, whether HSM-backed keys are required, and how recovery, rotation and network access will be governed.

What is Azure Key Vault used for?

Azure Key Vault is used to store and control access to sensitive application material such as passwords, API keys, tokens, connection credentials, encryption keys and certificates. Microsoft positions the service around three main jobs: secrets management, key management and certificate management. Applications can retrieve protected values at runtime instead of embedding them in code or distributing them manually across servers.

This is useful for Azure applications, but Key Vault is not limited to workloads hosted in Azure. Microsoft states that keys can be used by applications hosted in Azure, another cloud or on premises. The main benefit is centralizing sensitive material behind identity and authorization controls so teams can rotate or revoke access without redeploying every application that uses the secret.

What is the difference between Standard, Premium and Managed HSM?

Microsoft currently offers Standard and Premium Key Vault tiers. Standard uses software-protected keys, secrets and certificates and is intended for common application security scenarios. Premium adds support for HSM-protected keys and is aimed at workloads that require stronger cryptographic protection. Microsoft states that Premium HSM-protected keys use FIPS 140-3 Level 3 validated hardware.

Azure Managed HSM is a separate Key Vault resource type rather than simply another vault tier. It is dedicated to HSM-protected cryptographic keys and is better suited to organizations that need a managed, highly controlled HSM service for key management. Buyers should not select Premium or Managed HSM only because the name sounds more secure. The requirement should come from the application's cryptographic, regulatory and key-custody needs.

How does access control work in Key Vault?

Azure Key Vault separates resource management from access to the stored keys, secrets and certificates. Microsoft recommends Azure role-based access control for managing data-plane permissions and states that, starting with Key Vault API version 2026-02-01, Azure RBAC is the default access model for newly created vaults. RBAC can assign permissions at management group, subscription, resource group, vault or supported object scopes.

Older Key Vault access policies still exist, so organizations with established environments may encounter both models. Teams should standardize deliberately rather than mixing authorization approaches without a reason. Managed identities can reduce the need to distribute application credentials, and production designs should apply least privilege so each workload can read or use only the specific material it needs.

How should teams protect against accidental or malicious deletion?

Microsoft documents soft delete and purge protection as core Key Vault recovery controls. Soft delete keeps a deleted vault or vault object recoverable for a configurable retention period, with 90 days used as the default in Microsoft's current portal quickstart. Once soft delete is enabled it cannot be disabled. Purge protection adds a time-based lock that prevents permanent deletion until the retention period has elapsed.

Purge protection is intentionally difficult to bypass. Microsoft states that no administrator role, permission or Microsoft operator can override it after it is enabled. That is valuable for production key protection, but it also means teams need to understand the operational consequence before turning it on in short-lived test environments. Recovery settings, vault naming and deletion procedures should be part of deployment standards rather than left to individual project teams.

How does Azure Key Vault pricing work?

Azure Key Vault does not have one flat monthly subscription price. Microsoft's current pricing model charges according to the type and number of operations performed against secrets, certificates and keys. Standard and Premium vaults have transaction pricing, while HSM-protected keys in Premium can add per-key charges in addition to operation charges. Automated key rotation has its own meter, and Managed HSM pools are billed separately based on provisioned HSM usage.

Exact rates vary by agreement, region and currency, so BrandLigo does not hard-code one price as the cost of Key Vault. Pricing was checked against Microsoft's Azure Key Vault pricing page on August 25, 2026. Buyers should estimate expected transaction volume, number of HSM-protected key versions, certificate operations, rotation activity and any Managed HSM requirements before calculating production cost.

What security practices matter beyond putting a secret in a vault?

Using Key Vault does not automatically make an application secure. Microsoft recommends least-privilege access, soft delete, purge protection and regular rotation of cryptographic material. Organizations should also decide whether the vault is reachable publicly or only through controlled network paths, how administrators are separated from applications, how access is logged and monitored, and who can recover or purge deleted material.

Secret rotation needs application planning. A new secret version is only useful if consuming applications can discover and use it safely. Certificates and encryption keys can have similar lifecycle dependencies. Teams should design rotation, expiry alerts, emergency revocation and rollback before production rather than treating Key Vault as a passive storage location.

What are the main limitations and tradeoffs?

Key Vault is a security service, not a general configuration database. Applications that place every non-sensitive setting in Key Vault can create unnecessary complexity, extra network calls and harder troubleshooting. Availability and latency also matter because applications that require a secret during startup or every request need a resilient access pattern and should avoid excessive runtime dependence on repeated vault calls.

Authorization and networking can be another source of operational friction. RBAC, private networking, managed identities, deployment pipelines and cross-subscription access need to be designed together. HSM-backed protection also costs more and can introduce stricter operational processes. Buyers should match the protection level to the actual risk rather than using the most restrictive option for every workload.

Who should choose something else?

Teams that only need application configuration with no sensitive values should use an appropriate configuration service or application settings rather than forcing all configuration into Key Vault. Organizations that need a dedicated HSM service for cryptographic keys should evaluate Azure Managed HSM instead of treating a normal vault as equivalent. Workloads that require a third-party or multicloud secrets platform with one consistent control plane may also compare specialist secrets-management products.

Azure Key Vault is strongest for organizations that want Azure-native management of application secrets, keys and certificates with Microsoft Entra identity, RBAC, recovery controls and integration across Azure services. It is a better choice when central security and lifecycle management are more important than keeping credentials inside each application or server.