Azure Key Vault

Centralized secret, key, and certificate store with HSM-backed keys, soft delete, access policies or RBAC, and integration with App Service, Functions, and Logic Apps.

AzureIntermediate

Why

Key Vault is the single source of truth for secrets in Azure — it provides audit logging, automatic rotation (for supported secret types), HSM-backed keys for compliance, and Managed Identity access so no secret is ever in code or config. App Service/Functions can reference vault secrets as app settings that stay in sync. Azure holds 21% cloud market share (Synergy Research Q4 2024).

Azure is the default for enterprises with Microsoft 365 / Active Directory estates — 95% of Fortune 500 use Azure. AKS and Cosmos DB are first-class for .NET workloads.

When

Use Key Vault for any secret (DB passwords, API keys, TLS private keys) in Azure-hosted apps. Use Managed HSM for FIPS 140-2 Level 3 compliance.

Avoid storing non-secret config (feature flags, URLs) in the vault — use App Configuration for those, reserving the vault for true secrets.

How

1. Create a Key Vault (Standard for software keys, Premium for HSM). 2. Add secrets with az keyvault secret set. 3. Enable RBAC (recommended) or access policies; assign the 'Key Vault Secrets User' role to your app's managed identity. 4. Reference secrets in App Service as @Microsoft.KeyVault(SecretUri=...). 5. Enable soft delete and purge protection (on by default in new vaults). 6. Set up rotation policies for supported secret types. ```bash az keyvault create --name myvault --resource-group rg --enable-rbac-authorization true az keyvault secret set --vault-name myvault --name DbPassword --value "P@ssw0rd!" az role assignment create --role "Key Vault Secrets User" --assignee \${APP_PRINCIPAL_ID} --scope /subscriptions/.../resourceGroups/rg/providers/Microsoft.KeyVault/vaults/myvault ```

Example

App Service app setting referencing a Key Vault secret (resolves automatically, no secret in config): ```bash az webapp config appsettings set --name myapp --resource-group rg \ --settings "DB_PASSWORD=@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/DbPassword/)" ``` Node.js fetching a secret with Managed Identity at runtime: ```ts import { SecretClient } from "@azure/keyvault-secrets"; import { DefaultAzureCredential } from "@azure/identity"; const client = new SecretClient("https://myvault.vault.azure.net", new DefaultAzureCredential()); const { value } = await client.getSecret("DbPassword"); ```

Common Problems

⚠App Service cannot resolve @Microsoft.KeyVault reference — the app's managed identity lacks the 'Key Vault Secrets User' role on the vault; assign the role and restart the app.
⚠Forbidden (403) when reading secret — RBAC is enabled but the caller's identity lacks the role; with access policies, the policy must list the principal's objectId.
⚠Soft-deleted secret blocks re-creation — purge the deleted secret first with az keyvault secret purge, or use a new secret name during rotation.

Best Practices

✓Use RBAC authorization (not access policies) — it is role-based, works with PIM just-in-time, and is consistent with the rest of Azure.
✓Give each environment (dev/staging/prod) its own vault so a compromised dev identity cannot read prod secrets.
✓Enable purge protection and soft delete so a malicious or accidental delete cannot permanently destroy secrets before the retention window expires.

FAQ

What is Azure Key Vault and what problem does it solve?

Centralized secret, key, and certificate store with HSM-backed keys, soft delete, access policies or RBAC, and integration with App Service, Functions, and Logic Apps. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Azure Key Vault in 5 minutes?

Two steps to run it: (1) Create a Key Vault (Standard for software keys, Premium for HSM).; (2) Add secrets with az keyvault secret set.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Azure Key Vault?

The most frequent issue is: App Service cannot resolve @Microsoft.KeyVault reference — the app's managed identity lacks the 'Key Vault Secrets User' role on the vault; assign the role and restart the app.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Azure Key Vault?

Best practices for Azure Key Vault include: Use RBAC authorization (not access policies) — it is role-based, works with PIM just-in-time, and is consistent with the rest of Azure.; Give each environment (dev/staging/prod) its own vault so a compromised dev identity cannot read prod secrets.; Enable purge protection and soft delete so a malicious or accidental delete cannot permanently destroy secrets before the retention window expires.. The first one — "Use RBAC authorization (not access policies) — it is role-based, works with PIM just-in-time, and is consistent with the rest of Azure." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Azure Key Vault?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Azure Key Vault options offer a free tier — validate within free quota before scaling.