Why Key Vault Matters

Applications often need secrets, keys, and certificates — API keys, database connection strings, TLS certs. Storing these in code or config files is a major security risk. Azure Key Vault provides a centralized, secure, and managed way to protect sensitive data.

As a Solution Architect, you must know when and how to use Key Vault to ensure compliance, secure access, and automation.

Azure Key Vault – Core Capabilities

1. Secrets Management

• Store and retrieve sensitive values securely.

• Example: connection strings, passwords, API keys.

2. Key Management

• Create and manage cryptographic keys (RSA, HSM-backed).

• Supports encryption, decryption, signing.

• FIPS 140-2 compliant HSMs for compliance-heavy industries.

3. Certificate Management

• Store and manage TLS/SSL certificates.

• Integrates with Certificate Authorities for auto-renewal.

4. Integration

• Works with Azure Managed Identities (no hardcoded credentials).

• Integrates with Azure Storage, SQL, AKS, Functions, App Services, etc.

Access Control

• RBAC Integration – assign roles like Key Vault Reader, Key Vault Secrets Officer.

• Access Policies – fine-grained control at vault level (legacy model).

• Private Endpoints – restrict access to VNET private IPs (no public exposure).

• Logging – monitor access via Azure Monitor and Activity Logs.

Design Best Practices

1. Use Managed Identities

• Let apps authenticate to Key Vault without storing credentials.

2. Limit Permissions

• Developers = read-only secrets.

• Security team = manage keys & rotation.

• Use PIM for elevated access.

3. Enable Soft-Delete & Purge Protection

• Prevent accidental or malicious deletion of secrets.

4. Integrate with CI/CD

• Automate secret retrieval for pipelines (Azure DevOps, GitHub Actions).

Example Enterprise Scenario

A healthcare company requires:

• All API keys and DB connection strings stored securely.

• TLS certificates auto-renewed without downtime.

• Only authorized apps should access secrets, no hardcoded credentials.

Correct design:

• Store all secrets in Azure Key Vault.

• Use Managed Identities for apps to retrieve secrets.

• Enable auto-renewal of TLS certs.

• Apply RBAC roles with least privilege.

Confusion Buster

• Key Vault vs App Configuration

  • Key Vault = secrets, certificates, keys.

  • App Config = app settings & feature flags.

• Access Policies vs RBAC

  • Access Policies = older model, limited.

  • RBAC = recommended, unified model.

• Soft Delete vs Purge Protection

  • Soft Delete = temporarily recoverable after deletion.

  • Purge Protection = prevents permanent deletion until retention expires.

Exam Tips

• “Which Azure service stores and manages secrets and certificates?” → Key Vault.

• “Which feature prevents accidental permanent deletion?” → Soft Delete + Purge Protection.

• “Which feature enables apps to access secrets without credentials?” → Managed Identity integration.

• “Where should feature flags be stored?” → App Configuration, not Key Vault.

What to Expect in the Exam

• Direct Q: “Which service securely stores API keys and connection strings?” → Key Vault.

• Scenario Q: “Company wants to auto-renew TLS certs for its app.” → Key Vault Certificates.

• Scenario Q: “Company requires apps to securely access secrets without embedding passwords.” → Key Vault + Managed Identities.

• Trick Q: “App Configuration and Key Vault are interchangeable.” → False.