Azure Key Vault
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is Azure Key Vault?
Azure Key Vault is a managed service for protecting secrets, encryption keys and certificates used by applications and infrastructure. This profile connects the concept to KBY's practical engineering guidance.
Vault access is governed through Microsoft Entra identities and Azure authorisation, while keys may be software-protected or backed by hardware security modules. Rotation, network controls, logging and recovery settings are essential parts of a production design.
Centralise sensitive key material and grant applications controlled access to it.
- Managing application secrets
- Storing SSL/TLS certificates
- Cryptographic key management
Explore related technologies
Parent technology
5 resources for Azure Key Vault
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with Azure Key Vault
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Config Traps(4)
Recognise and avoid known failure modes.
- Rotation Service Principals Inherit Key Vault PurgeA secret-rotation identity holding purge rights can erase every version of a Key Vault secret outright, skipping the 90-day soft-delete window entirely. Once triggered by a scripting error or a leaked credential, no vault backup, RBAC lockout, or incident response runbook restores what was purged. Open
- Key Vault Access Policy Templates Bundle Purge RightsA CI/CD service principal holding the Azure Key Vault access policy preset for certificate, key and secret management inherits the purge permission alongside routine lifecycle rights. If that principal's credential leaks, keys, secrets and certificates can be permanently destroyed within the recovery window, and standard soft-delete controls provide no backstop. Open
- RBAC Migration Bundles Purge Into Key Vault AdminAzure Key Vault's RBAC model has no built-in role for delete-without-purge, so migrating from access policies to Key Vault Administrator quietly grants permanent-erase rights to every principal in that assignment scope, with no separate toggle to strip it back out. Open
- Azure Key Vault: Purge Rights on Service PrincipalsTerraform or ARM templates copy an administrator access policy that grants CI/CD service principals the Purge permission on secrets, keys, or certificates. A compromised pipeline can then permanently destroy vault objects during the soft-delete window with no MFA, approval, or recovery path. Open
Incident Runbooks(1)
Stabilise, recover and validate during incidents.