Azure Key Vault

Overview

Azure Key Vault is Microsoft's managed service for storing secrets, encryption keys and TLS certificates, with callers authenticated by Microsoft Entra ID and authorized through Azure RBAC. It has been generally available since 2015 and is a Microsoft service, so there is no separate ownership to track. It comes in three forms: Standard vaults (software-protected keys, FIPS 140 Level 1), Premium vaults (adding HSM-protected keys in FIPS 140-3 Level 3 validated HSMs, per the Microsoft overview), and Managed HSM, a single-tenant HSM pool. For workloads on Azure it is the default place to keep credentials out of code.

What it is good at

Identity integration is the strength. Applications use Azure managed identities to read secrets, so there is no bootstrap credential to hide, and RBAC on the data plane ties into Privileged Identity Management for time-limited admin access. One service covers secrets, keys and X.509 certificates, including enrollment and renewal with integrated public CAs, which removes a separate certificate tool for many Azure estates. It is wired into Azure Disk Encryption, SQL Transparent Data Encryption and Always Encrypted, App Service certificates and Storage customer-managed keys. Keys can rotate automatically on a policy. Soft delete is on by default for new vaults, with a 7 to 90 day recovery window, and diagnostic logs stream to Azure Monitor, Event Hubs or storage.

Where it falls short

Secret rotation is do-it-yourself. Key Vault emits a SecretNearExpiry event to Event Grid and you run an Azure Function that changes the credential, and Microsoft's rotation tutorial admits a gap where the stored secret cannot authenticate. There are no dynamic, leased database credentials of the kind HashiCorp Vault issues. Secrets are capped at 25 KB, and each vault is throttled (4,000 general transactions per 10 seconds per region, 300 for secret creates and imports), which pushes high-volume apps toward caching. The legacy access-policy model, still common in older vaults, lets any Contributor grant themselves data access; Microsoft's RBAC guidance calls it a risk and makes RBAC the default from API version 2026-02-01. Purge protection is off by default. Outside Azure, callers still need an Entra identity.

Pricing

Published, usage-based and low. Azure's retail price list for East US shows $0.03 per 10,000 operations, $1 per HSM-protected RSA 2048-bit key per month (Premium), $3 per certificate renewal and $1 per automated key rotation, with Managed HSM from $3.20 per pool per hour (pricing page). See how that compares with quote-only vendors in the Identity Pricing Transparency Index 2026.

Best for, and who should look elsewhere

Use it for any Azure-hosted workload: a vault with RBAC, managed identities and purge protection takes an afternoon, and the remaining effort is per-application vault design and rotation functions. Organizations needing dedicated key custody should budget for Managed HSM. Look elsewhere for dynamic secrets or one control plane across clouds (HashiCorp Vault or Infisical), and pair it with AWS Secrets Manager or Google Cloud Secret Manager in multi-cloud estates. See the secrets management rankings.

Bottom line

The right default for secrets, keys and certificates on Azure, because managed identities remove the bootstrap credential. Turn on RBAC and purge protection on day one, and plan your own secret rotation.