Azure Key Vault

Overview

Azure Key Vault is the only one of the three cloud services in this category that is genuinely both a key management service and a secret store.

Its object model is three types in one service, keys, secrets and certificates, each versioned and each addressable by its own web address, with certificates built on top of the other two.

Certificate lifecycle with automated renewal is a real product rather than a side effect, which neither of the other two cloud services offers at all.

There are two resource shapes and the difference is isolation. Standard vaults are multi-tenant and hold all three object types, while managed hardware pools are single-tenant, hold keys only, and cost by the hour.

Read the assurance levels carefully, because the tier summary oversimplifies. Software keys are validated at the lowest level, and premium vault keys may be at either the older or the newer standard depending on when they were created.

The reason is a fleet firmware upgrade: the newer hardware platform now protects all new keys and versions, so an older key may still sit at the previous level, and you check an attribute on the key version to find out.

What it does not do is issue dynamic credentials. There is no leased database login here; the nearest equivalent is a managed identity, which solves the bootstrap secret problem rather than brokering downstream access.

Rotation is not automatic by default. You define a policy per key, with a minimum interval of seven days, and every scheduled rotation is separately billed, which is unusual among these five.

Rotation semantics also need care: it creates a new version and rewraps data keys, but does not re-encrypt your data, and consuming services can take a day or more to pick up the new version.

Two published items are preview rather than generally available, namely external key management and symmetric hardware keys in premium vaults, and the managed storage key feature is deprecated outright.

Key features and capabilities

The same headings are used for every secrets & key management entry, so two tools can be read side by side.

What it stores

• Genuine secret storage for passwords, tokens and connection strings, versioned and retrieved by address
• Secrets are a vault-only capability and are not supported in the single-tenant hardware pools
• Certificate management covers provisioning, deployment and automated renewal, including for purchased public certificates
• No published limit on the number of keys, secrets, certificates or versions, though backup degrades past 500 versions
• The managed storage account key feature is deprecated and should not be treated as current

Key management and cryptography

• Vaults support the common asymmetric families in software or hardware, with symmetric hardware keys still in preview
• The single-tenant pools are hardware-only and validated at the highest common level for cloud key services
• Assurance varies by hardware platform within premium vaults, so an older key version may sit at the previous standard
• Importing keys generated in your own hardware module is supported into both vaults and pools
• Holding keys outside Azure entirely is preview, wrap and unwrap only, and explicitly outside the service agreement

Dynamic and short-lived credentials

• No dynamic credential generation, no leases and no database credential brokering at all
• The nearest equivalent is a managed identity, where the platform rotates the identity so no bootstrap secret is stored
• Cryptographic operations run inside the service so the key never leaves the boundary
• Secure key release exports a key only to a workload presenting a valid attestation token
• That release mechanism is designed for confidential computing and trusted launch scenarios

Access control and authentication

• Authentication is through the Microsoft identity service, with managed identities the recommended pattern
• Authorisation is either role-based access control across both planes or the older vault access policy model
• The single-tenant pools carry their own local roles that subscription administrators cannot override
• Vaults are multi-tenant with per-application segregation the recommended design, while pools are dedicated per customer
• Each pool has a customer-specific security domain that cryptographically isolates its cluster

Audit and rotation

• Logging is opt-in per vault, then archived to storage, streamed to an event service or sent to the monitoring service
• Key usage is logged in near real time, and you control and may delete your own logs
• Rotation requires a per-key policy, minimum seven days, and each scheduled rotation is billed separately
• Published guidance is to rotate encryption keys at least every two years
• A built-in policy definition audits whether keys have a rotation policy at all, with scans taking up to a day

Integrations

• Deep integration with platform services for disk encryption, database encryption, storage keys and certificates
• Single-tenant pools integrate with storage, event streaming and log analytics, sharing the same API as vaults
• That shared API means moving from a multi-tenant vault to a dedicated pool needs no application rework
• Cryptographic objects follow the standard web key formats with vendor extensions
• Orchestrator and pipeline integrations are not named on the service pages, so treat those as unconfirmed here

Where it runs and what it costs

• Managed service only, with no self-hosted option, and zone-resilient where zones exist
• Vault contents replicate within a region and to a paired secondary region with automatic failover
• Government and separately operated sovereign clouds are supported with distinct service addresses
• Published throughput ceilings are weighted by key size, so larger keys consume the quota several times faster
• Pricing units are per ten thousand operations, per hardware key per month, per rotation, per renewal and per hour for pools

Pricing

Usage-basedFrom $0.03 per 10,000 operations

Consumption-based with real published rates. In the reference region, operations cost $0.03 per ten thousand and advanced key operations $0.15, hardware-protected keys start at $1.00 per key per month with larger key types tiered from $5.00 down to $0.40, and each automated rotation or secret renewal is $1.00 while a certificate renewal request is $3.00. The single-tenant hardware pool is the item that changes the shape of a bill at $3.20 per hour and should not be confused with the separate dedicated hardware service at $4.85. No free tier and no trial length are published.

Vendor pricing page →

Demos and videos

• Key Vault hardware security module explainer Tutorial · YouTube
• Hardware security modules for data sovereignty Webinar or talk · YouTube

About Microsoft

Key Vault is a first-party Microsoft service with no acquisition history, sold as part of Azure under consumption billing rather than as licensed software, and available to anyone with a subscription. This profile deliberately omits Microsoft corporate figures such as revenue, headcount and customer counts, because the documentation and pricing domains that carry the product detail publish none of them, and restating them from elsewhere would break the first-party rule applied across this catalogue. What those pages do establish is operational scope: sovereign and air-gapped clouds are supported with their own separate service addresses, covering the government cloud and the separately operated China cloud, and Microsoft states the service is designed so that it cannot see or extract your data.

Redmond, Washington · azure.microsoft.com