Azure Key Vault is a secure cloud safe for secrets (passwords, API keys, connection strings), keys (encryption keys) and certificates (TLS/SSL). Apps fetch these values at runtime using a managed identity, so nothing sensitive is written into code or config files — and every access is logged.
📑 On this page · 7 sections
Understanding Key Vault in Azure
Think of Key Vault as a locked safe in the cloud. Only people and apps you allow can open it.
Secrets
Passwords, API keys and connection strings.
Keys
Encryption keys used to encrypt and sign data.
Certificates
TLS/SSL certificates for websites and services, with auto-renewal support.
How Key Vault improves security
No secrets in code
Values live in the vault, not in source files or config.
Strong access control
Microsoft Entra ID and Azure RBAC decide who can read what.
Managed identities
Apps sign in to Key Vault without storing any password.
Audit logs
See who accessed which secret and when.
Hardware protection
Premium tier and Managed HSM protect keys in HSMs.
Recovery
Soft delete and purge protection help recover deleted items.
Pros and cons of Azure Key Vault
• Central, secure storage for secrets, keys and certificates
• Works with most Azure services
• Fine-grained access control and logging
• Certificate auto-renewal support
• Low cost for typical use
• Needs setup: roles, network rules, identities
• Request limits apply — chatty apps should cache values
• HSM options cost more
🔐 Want hands-on practice with Key Vault, managed identities and RBAC? Join a free demo class.
Book a free demoAzure Key Vault pricing
Key Vault is pay-as-you-go. Your bill depends on:
• The tier — Standard or Premium
• The number of operations (reads and writes)
• HSM-protected keys (Premium)
• Certificate renewals
• Managed HSM, billed separately per hour
Check current rates on the official Key Vault pricing page.
What is Azure Key Vault used for?
Web app connection strings
Database connection strings read at runtime.
Third-party API keys
Payment, email or SMS provider keys.
TLS certificates
Certificates for websites, renewed automatically.
Customer-managed keys
Encryption keys for Azure Storage or SQL.
CI/CD pipelines
Secrets for Azure DevOps pipelines.
Data pipelines
Credentials for Data Factory and Databricks.
Key Vault vs config files, and vs Managed HSM
| Config files / code | Azure Key Vault | |
|---|---|---|
| Security | Easy to leak (e.g. pushed to Git) | Encrypted, access-controlled |
| Rotation | Update every app and redeploy | Update once in the vault |
| Auditing | None | Full access logs |
| Access control | Anyone with the file | Only allowed users and apps |
Key Vault (Standard / Premium)
Multi-tenant service for secrets, keys and certificates. Premium adds HSM-protected keys.
Managed HSM
Dedicated, single-tenant HSM pool for keys only — for strict compliance needs.
✅ ✅ Rule of thumb: Most applications only need Key Vault Standard or Premium. Use it with managed identities and Azure RBAC.
Go deeper
Read our complete Azure Key Vault guide for setup steps, or explore the Azure DevOps and Azure Data Engineer courses.
Frequently asked questions
What is Azure Key Vault?
A Microsoft Azure service that securely stores and controls access to secrets, encryption keys and certificates.
Is Azure Key Vault free?
No, but it is low-cost for typical use. You pay mainly per operation, with extra charges for HSM-protected keys.
What is the difference between a key and a secret?
A secret is any sensitive value you store and read back, like a password. A key is a cryptographic key used to encrypt or sign data without exposing the key itself.
How do apps access Key Vault securely?
Using a managed identity and Azure RBAC, so no password is stored in the app.
Can I recover a deleted secret?
Yes, if soft delete is on (it is by default), within the retention period.