Azure Key Vault

Azure Key Vault is a cloud service from Microsoft Azure for storing and managing secrets, encryption keys, and certificates. It gives organizations a central place to keep sensitive credentials out of application code, configuration files, and scripts.

Key Vault manages three types of objects. Secrets include passwords, API keys, connection strings, and tokens. Keys are cryptographic keys used to encrypt data, including customer-managed keys for services like Azure Storage and Azure SQL Database. Certificates are TLS/SSL certificates that Key Vault can provision, store, and renew automatically. Key Vault is offered in two tiers: Standard, which protects keys in software, and Premium, which protects keys in hardware security modules (HSMs). For organizations that need a dedicated, single-tenant HSM, Azure also offers Managed HSM.

To use Key Vault, teams create a vault, add their secrets, keys, and certificates, and control who can access them through Microsoft Entra ID and Azure role-based access control (RBAC). Applications then retrieve credentials from the vault at runtime instead of storing them locally. Access activity can be logged and sent to Azure Monitor, giving security teams a record of who accessed what and when. Features like soft delete and purge protection help prevent accidental or malicious deletion of critical keys.

One of the key benefits of Azure Key Vault is that it reduces the risk of credential exposure. When secrets live in a vault with strict access controls and automated rotation, a leaked config file or code repository is far less likely to hand an attacker the keys to production data.