Azure Key Vault provides secure storage for secrets, cryptographic keys, and certificates. Applications authenticate and retrieve credentials at runtime, reducing the risk of storing sensitive values in code or configuration files.
What is Azure Key Vault?
Azure Key Vault is a cloud service for securely storing and accessing secrets, encryption keys, and certificates. It centralizes secret management, reducing the risk of accidental exposure and simplifying credential rotation across applications.
Authentication is handled by Microsoft Entra ID (formerly Azure Active Directory). For newly created key vaults, Azure RBAC is now the default access control model for both the control plane and data plane; the older access-policy model is still supported but considered legacy and is being phased out in favor of RBAC. All access is logged, providing an audit trail for compliance requirements.
Core Features
- Secrets management: Store and retrieve passwords, connection strings, and API keys
- Key management: Create and control encryption keys (software or HSM-backed)
- Certificate management: Store certificates with automatic renewal from integrated CAs
- Access control: Microsoft Entra ID authentication with RBAC (default) or legacy access policies
- Audit logging: Track all operations through Azure Monitor
Typical Use Cases
Key Vault is essential for any application that uses credentials or encryption. Common scenarios include storing database connection strings, managing API keys for third-party services, handling SSL certificates, and providing encryption keys for data protection at rest.
Benefits
- Eliminates secrets in source code and config files
- Centralized rotation reduces credential sprawl
- HSM options in the Premium tier meet compliance requirements (FIPS 140-2)
- Native integration with Azure services and SDKs
Frequently Asked Questions
What is the difference between Standard and Premium tiers?
Standard tier uses software-protected keys. Premium tier stores keys in FIPS 140-2 Level 2/3 validated Hardware Security Modules (HSMs), required for certain compliance certifications.
How do applications authenticate to Key Vault?
Applications authenticate through Microsoft Entra ID. For Azure services, Managed Identity provides automatic credential management. For external apps, service principals or user credentials authenticate through Microsoft Entra ID.
What does Azure Key Vault cost?
Billing is per operation, with operations against HSM-backed keys in the Premium tier costing more than software-protected operations in the Standard tier. Current rates are available on the official pricing page.
How does Key Vault differ from Azure Managed HSM?
Key Vault provides multi-tenant secret and key management. Managed HSM offers dedicated, single-tenant HSMs for organizations that need exclusive control over cryptographic hardware.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory helps you implement Azure Key Vault: secret management strategy, migration from access policies to RBAC, and integration with your applications.
Available Tiers & Options
Standard
- Software-protected keys
- Cost-effective
- All key types
- No HSM protection
Premium
- HSM-protected keys
- FIPS 140-2 Level 2/3 validated HSMs
- High security
- Higher cost per operation
Typical Use Cases
Technical Specifications
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
