Tool profile
Azure Key Vault: cost, fit and limits
Azure Key Vault is a managed store made by Microsoft for secrets, encryption keys and certificates, with a Standard tier using software cryptography and a Premium tier that adds hardware security module protected keys. Access is authenticated through Microsoft Entra ID and authorized through Azure role-based access control or access policies.
What to know first
Azure Key Vault covers three jobs: secrets such as tokens and connection strings, keys for encryption and certificates for TLS. Two service tiers exist, Standard and Premium, and a separate Managed HSM pool is billed hourly. Prices are metered per 10,000 operations plus per-key fees for HSM keys, but the pricing page read showed placeholder amounts, so the dollar figures need the Azure calculator. The service integrates with Azure disk encryption, SQL and App Service.
Azure Key Vault at a glance
| Maker | Microsoft, United States |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI Secrets Management Software in 2026, rank 7 of 10 |
| Website | azure.microsoft.com/en-us/products/key-vault |
Who Azure Key Vault is best for
Azure application teams
Applications fetch a connection string by URI instead of storing it in code, and Entra ID decides which identity may read which secret.
Regulated workloads that need HSM keys
Premium offers HSM-protected RSA-HSM, EC-HSM and OCT-HSM keys on Marvell LiquidSecurity hardware validated to FIPS 140-3 Level 3. This suits regulated sectors.
Teams automating certificates
Key Vault can automate enrollment and renewal for certificates purchased from public CAs, which removes a common cause of outages.
Security teams who need logs
Vault activity can be archived to a storage account, streamed to an event hub or sent to Azure Monitor logs, and the customer controls retention.
Azure Key Vault plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Standard tier | Per 10,000 operations; rate not shown | Software-protected keys validated to FIPS 140 Level 1, secrets and certificates, billed by operations. No premium hardware features. |
| Premium tier | Per operation plus per-key monthly fee; rates not shown | Adds HSM-protected keys on FIPS 140-3 Level 3 hardware. Keys used in the previous 30 days are billed, and each version counts. |
| Managed HSM pool | Hourly usage fee per pool | Dedicated HSM pools, listed as Standard B1 on the pricing page, for customers who need single-tenant hardware key custody. |
Checked November 2026.
What Azure Key Vault does
- Secrets store
- Applications retrieve secrets by URI and can request a specific version, so a rotation can be rolled back by pointing the app to the previous one.
- Entra ID and RBAC
- Authentication runs through Microsoft Entra ID. Authorization can use Azure RBAC for both management and data access, or a vault access policy for data access only.
- Certificate lifecycle
- Certificates are provisioned, managed and deployed, and enrollment and renewal for public CA certificates can be automated. Renewals are billed per request. This removes a common cause of expired-certificate outages.
- Automated key rotation
- Scheduled key rotation is billed per rotation in both tiers. Storage account key rotation was in preview at the time of the pricing page, with a later general availability price.
- Replication
- Vault contents are replicated within a region and to a secondary region, so failover needs no administrator action. Microsoft says it does not see or extract customer data.
How Azure Key Vault handles your data
Microsoft's overview says all key vaults are encrypted at rest with keys stored in hardware security modules, that Premium uses FIPS 140-3 Level 3 validated Marvell LiquidSecurity HSMs, and that Key Vault is designed so Microsoft does not see or extract your data. Contents replicate within a region and to a secondary region. The documentation does not state compliance certifications, retention for deleted items, or AI data use for this service; the Microsoft privacy statement says data may be used to develop products including training AI models, without addressing Key Vault contents. Microsoft is headquartered in Redmond, Washington.
Where Azure Key Vault falls short in practice
- Price opacity. The pricing page read showed placeholder dollar signs. Budgeting requires the Azure pricing calculator or an enterprise agreement, and HSM keys have tiered monthly fees by key count.
- Best inside Azure. Authentication and authorization depend on Entra ID and Azure RBAC, so workloads on other clouds or on-premise need federation or service principals that your teams must manage.
- No agent features described. The overview mentions secrets, keys and certificates only. Teams issuing credentials to AI agents must build their own scoping, expiry and review process. Review it before agents get access.
Works with
Alternatives to Azure Key Vault
Azure Key Vault: common questions
What is the difference between Key Vault Standard and Premium?
Standard encrypts using software libraries validated to FIPS 140 Level 1. Premium adds HSM-protected keys generated and protected by FIPS 140-3 Level 3 validated Marvell LiquidSecurity HSMs. Secrets operations use the same meter on both tiers, according to the pricing page.
How is Azure Key Vault billed?
Secrets operations are charged per 10,000 transactions, certificate renewals per request and software keys per 10,000 transactions. Premium HSM keys add a monthly per-key fee, and Managed HSM pools are billed hourly. The page read showed no dollar amounts. Use the Azure calculator for actual figures.
Can Key Vault auto-renew certificates?
Yes. The overview says Key Vault automates tasks on certificates purchased from public CAs, such as enrollment and renewal. The pricing page lists renewals as billed per renewal request, and other certificate operations per 10,000 transactions. Renewals are the exception to the per-transaction meter.
Does Microsoft see what is in my vault?
The overview says Key Vault is designed so Microsoft does not see or extract your data, and that vaults are encrypted at rest using keys stored in HSMs. For contract terms and sub-processors, consult Microsoft's product terms. Contract terms sit in Microsoft product terms.
How do I monitor who read a secret?
Enable logging on the vault. Logs can be archived to a storage account, streamed to an event hub or sent to Azure Monitor logs. You control access to those logs and may delete logs you no longer need. Add alerts on unusual reads.