Azure Key Vault
Capability scores
Methodology →- Authentication
- 3.0
- SSO & Federation
- 3.0
- Authorization
- 3.5
- Lifecycle & Provisioning
- 3.0
- MFA & Passwordless
- 2.5
- Governance & Audit
- 4.0
- Developer Experience
- 4.0
- Deployment Flexibility
- 3.5
- Pricing Transparency
- 4.0
- Support & Ecosystem
- 4.0
Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.
Overview
Azure Key Vault is Microsoft's managed service for storing and accessing secrets, encryption keys, and certificates in Azure. It integrates natively with Entra ID for access control and with Azure services for consumption.
What it is good at
For Azure-native workloads it is the natural choice: managed secret and key storage, HSM-backed keys, certificate management, access governed by Entra identities and managed identities, and tight integration across Azure. It removes hardcoded secrets with minimal setup for teams already in Azure.
Where it falls short
It is Azure-centric, so multi-cloud organizations often want a cloud-neutral platform, and its dynamic-secrets and broad third-party integration story is lighter than dedicated secrets platforms like Vault.
Pricing
Transparent, usage-based Azure pricing, with a premium tier for HSM-backed keys.
Best for, and who should look elsewhere
Choose Key Vault for Azure-native secrets and keys. Look elsewhere for cloud-neutral or dynamic-secrets-heavy needs (see HashiCorp Vault).
Bottom line
The default managed secrets and key store for Azure, integrated with Entra identity.
More Secrets Management vendors
All Secrets Management →- GitGuardian4.3/5
- AWS Secrets Manager4.2/5
- Google Cloud Secret Manager4.2/5
- CyberArk Conjur4.1/5
- Doppler4.1/5
Related on Start with Identity
- VendorDelinea DevOps Secrets Vault
strong_contender
- CVESMB Server Kerberos reflection via Ghost SPNs
October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.
- CVEWindows SMB Client improper authentication (tampering)
Windows SMB Client improper authentication (CWE-287) that allows tampering. Not an Entra token bug, but it sits in the same Microsoft identity-adjacent patch tr
- CVEWindows SMB Kerberos reflection elevation of privilege
Kerberos authentication reflection on SMB, still abusable via Ghost SPNs after the first fix. High-severity elevation of privilege on Windows.
- Vendor1Password Secrets Automation
strong
- VendorAWS Secrets Manager
strong
By SWI Community Team · Last evaluated 2026-07-03
Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.