Azure Key Vault – Complete Guide

Azure Key Vault is a managed cloud service for securely storing and managing cryptographic keys, secrets, and certificates. This field guide covers SKUs, RBAC roles, Private Endpoints, secret rotation, Managed Identity access, KQL queries, and a production-ready checklist.

Azure Key Vault – Complete Guide
AZURE · Modern Endpoint Guides
🔑 Azure Key Vault

Azure Key Vault – Complete Guide

Azure Key Vault is a managed cloud service for securely storing and managing cryptographic keys, secrets (connection strings, API keys, passwords), and certificates. It eliminates the need to hardcode secrets in application code.

📅 Updated: July 2026 🎯 Audience: Azure Architects, Security Engineers Standard / Premium / HSM FIPS 140-2 Level 2/3 Auto-Rotation Private Endpoint

📋 Overview & SKUs

FeatureStandardPremiumManaged HSM
Key storageSoftware-protectedHSM-protectedDedicated HSM
FIPS level140-2 Level 1140-2 Level 2140-2 Level 3
RSA 4096 keys✅✅✅
Dedicated HSM tenant❌❌✅
Multi-region replicationAutomaticAutomaticConfigurable
Use caseDev/Test, standard appsRegulated workloads (PCI, HIPAA)Highest compliance requirement

🔐 Key Types

TypeAlgorithmUse Case
RSARSA 2048/3072/4096Encryption, TLS certificates, code signing
EC (Elliptic Curve)P-256, P-384, P-521JWT signing, ECDSA, faster operations
oct-HSM (Symmetric)AES 128/192/256Data encryption (Managed HSM only)

🎭 RBAC Roles

portal.azure.com › Key vaults › prod-keyvault › Access policies
📋 Overview
📊 Activity log
🔑 Keys
🔒 Secrets
📜 Certificates
🎭 Access policies
🌐 Networking
Key vaults › prod-keyvault › Access configuration
prod-keyvault | Access configuration
Azure role-based access control
Vault access policy
PrincipalRoleScope
WebApp-MIKey Vault Secrets UserThis vault
DevOps-SPKey Vault ReaderThis vault
💡 Use RBAC model (not legacy Access Policies) — more granular, auditable
📸 Key Vault RBAC — assign least-privilege roles per identity
RoleCan Read Secrets?Can Manage?Use Case
Key Vault Administrator✅✅Full management (use with PIM)
Key Vault Reader❌ (metadata only)❌View vault properties
Key Vault Secrets Officer✅✅Manage secrets lifecycle
Key Vault Secrets User✅❌App access to secrets
Key Vault Crypto Officer—✅Manage keys
Key Vault Crypto User—❌Use keys for crypto operations
Key Vault Certificate Officer—✅Manage certificate lifecycle

🌐 Network Security

Key Vault should never be publicly accessible. Use Private Endpoint to restrict access to your VNet only.

# PowerShell – Create Private Endpoint for Key Vault
$vault = Get-AzKeyVault -VaultName "prod-kv" -ResourceGroupName "rg-security"
$pe = New-AzPrivateEndpoint `
    -Name "pe-keyvault" `
    -ResourceGroupName "rg-security" `
    -Location "eastus" `
    -Subnet $subnet `
    -PrivateLinkServiceConnection (New-AzPrivateLinkServiceConnection `
        -Name "conn-keyvault" `
        -PrivateLinkServiceId $vault.ResourceId `
        -GroupId "vault")
⚠️
Disable public network access after creating the Private Endpoint. Set Firewall → Selected Networks → Default Action: Deny. Exception: Allow Trusted Microsoft Services.

🔄 Secret Rotation

Automatic rotation uses Event Grid → Azure Function to rotate secrets before expiry.

  1. Secret approaches expiry → Key Vault emits Event Grid event
  2. Event Grid triggers Azure Function (rotation function)
  3. Function generates new secret value in the backend service
  4. Function creates new secret version in Key Vault
  5. Application reads the latest version automatically (no code change)

🤖 Managed Identity Access

Use Managed Identity for app access to Key Vault — no secrets in code or config files.

# Python – Access Key Vault with Managed Identity
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

credential = DefaultAzureCredential()  # Uses Managed Identity in Azure
client = SecretClient(
    vault_url="https://prod-kv.vault.azure.net/",
    credential=credential
)

secret = client.get_secret("db-connection-string")
print(secret.value)

💾 Backup & Recovery

  • Soft Delete: Deleted keys/secrets are retained for 7–90 days. Enable soft delete + purge protection on all vaults.
  • Purge Protection: When enabled, even admins cannot permanently delete objects during the retention period.
  • Key Vault Backup: Back up individual secrets/keys/certs. Restore only to same tenant (cross-tenant restore not supported).

🔎 KQL Queries

All Key Vault Access Events

AzureDiagnostics
| where ResourceType == "VAULTS"
| where OperationName in ("SecretGet","KeyGet","CertificateGet")
| project TimeGenerated, identity_claim_appid_g,
          CallerIPAddress, OperationName, ResultType
| order by TimeGenerated desc

Failed Access Attempts

AzureDiagnostics
| where ResourceType == "VAULTS"
| where ResultType == "Unauthorized" or ResultType == "Forbidden"
| summarize FailCount = count() by CallerIPAddress, identity_claim_appid_g, bin(TimeGenerated, 1h)
| where FailCount > 5
| order by FailCount desc

Secrets Nearing Expiry

AzureActivity
| where OperationNameValue contains "secrets" and OperationNameValue contains "write"
| extend SecretName = tostring(Properties.resource)
| project TimeGenerated, Caller, SecretName, OperationNameValue

✅ Checklist – Azure Key Vault

    🚀 Initial Setup
  • Create separate Key Vaults per environment (Dev/Stage/Prod)
  • Enable RBAC authorization mode (not legacy Access Policies)
  • Enable Soft Delete with 90-day retention
  • Enable Purge Protection on production vaults
    • 🌐 Network
  • Create Private Endpoint for each production vault
  • Disable public network access after Private Endpoint is created
  • Enable Trusted Microsoft Services exception
    • 🔄 Operations
  • Set expiry dates on all secrets (maximum 1 year)
  • Configure automatic rotation via Event Grid + Azure Function
  • Use Managed Identity for all app access (no hardcoded secrets)
    • 📊 Monitoring
  • Enable Diagnostic Settings → Send to Log Analytics
  • Create Defender for Key Vault alert policies
  • Alert on unauthorized access attempts