Why Key Vault?

Modern applications and cloud services rely heavily on secrets, encryption keys, and certificates. Storing these directly in code, config files, or VMs is insecure and creates risk.

Azure Key Vault provides a centralized, secure, and compliant way to manage sensitive data. It ensures only authorized apps and users can access secrets, and it integrates natively with Azure services.

For a Solution Architect, the design decision is when and how Key Vault should be used within the environment.

Core Features of Key Vault

1. Secrets Management

• Store API keys, passwords, connection strings.

• Applications retrieve secrets securely at runtime.

• Secrets can be versioned and rotated automatically.

2. Key Management

• Supports symmetric and asymmetric encryption keys.

• Keys can be generated, imported, or managed in Key Vault.

• Used for disk encryption, SQL TDE (Transparent Data Encryption), storage service encryption.

3. Certificate Management

• Secure storage for TLS/SSL certificates.

• Automatic renewal with some certificate authorities.

• Centralized lifecycle management of app certificates.

4. Integration with Azure Services

• Virtual Machines (disk encryption keys stored in Key Vault).

• App Services and Functions (fetch secrets via managed identity).

• SQL and Storage accounts (customer-managed keys stored in Key Vault).

Access Control for Key Vault

• Access Policies:

  • Define which users/apps can perform specific actions (e.g., Get secret, List keys).

  • Traditional method, still widely used.

• Azure RBAC (newer model):

  • Use role assignments instead of separate policies.

  • Provides unified control and aligns with standard Azure governance.

Best Practice: Use RBAC for consistency across Azure, but understand access policies for exam scenarios.

Design Considerations

1. High Availability

• Key Vault is a regional service, but can replicate to paired regions.

• For global applications, design multiple vaults in different regions.

2. Disaster Recovery

• Enable soft-delete and purge protection → prevents accidental or malicious deletion.

3. Security

• Always integrate with managed identities for applications.

• Avoid embedding secrets in code.

4. Performance

• Minimize excessive calls to Key Vault by using caching strategies (e.g., cache tokens in memory).

Example Enterprise Scenario

A bank’s application needs to:

• Store SQL DB connection strings.

• Encrypt customer data with customer-managed keys.

• Secure SSL certificates for a web portal.

Correct design:

• Use Key Vault for secrets and certificates.

• Store encryption keys in Key Vault for SQL TDE.

• Enable RBAC with managed identities for apps to retrieve secrets.

Confusion Buster

• Key Vault vs App Configuration:

  • Key Vault = secure secrets and keys.

  • App Configuration = feature flags and app settings (non-sensitive).

• Key Vault vs Defender for Cloud:

  • Key Vault = stores secrets.

  • Defender = monitors security compliance.

Exam Tips

• “Where to store API keys securely?” → Key Vault.

• “How to manage customer-managed encryption keys for SQL?” → Key Vault.

• “Prevent permanent deletion of secrets” → Enable soft-delete and purge protection.

• “Which service integrates with apps to securely fetch secrets?” → Key Vault with managed identity.

What to Expect in the Exam

• Direct Q: “Which Azure service stores and manages application secrets?” → Key Vault.

• Scenario Q: “Company needs to manage disk encryption keys and rotate TLS certs automatically.” → Key Vault.

• Trick Q: “App Configuration is used to store passwords.” → False (that’s Key Vault).