Click here to Skip to main content
15,397,385 members
Articles / Hosted Services / Azure
Posted 10 Nov 2018


5 bookmarked

Overview of Azure Key Vault

Rate me:
Please Sign up or sign in to vote.
5.00/5 (4 votes)
10 Nov 2018CPOL4 min read
What is Azure Key Vault and where is it useful?

Introduction - from Hardware to the Cloud!

A hardware security module (HSM) is a physical computing device which safeguards and manages digital keys. They are used when security is important and include features such as auditing, tamper-proofing and encryption. However, as with all hardware devices, there is expense and work involved in procuring, installing, upgrading and maintaining an HSM. This is where Azure Key Vault comes in. It provides the security of an HSM, but without the work of setting it up or maintaining it.

Image 1

What’s Azure Key Vault Used For?

Whatever is stored in Azure Key Vault is safeguarded using industry-standard algorithms, HSMs and key lengths. The HSMs are Level 2 validated for Federal Information Processing Standard (FIPS). Microsoft provides the interface with which you can access the HSM device securely. For more assurance about the integrity of the key, you can generate it inside the HSM. Microsoft cannot access or extract your keys. Applications also have no direct access to the keys. Instead, you’ll have to use Azure CLI, Portal or PowerShell as an interface.
Azure Key Vault can be used for key management as it makes it easy to create and control the encryption keys used to encrypt your keys. It can also be used for certificate management to enable you to easily provision, manage and deploy Secure Sockets Layer/Transport Layer Security (SSL/TLS).
Azure Key Vault supports three types of data, including:

  • Secrets. These are values that are 25KB or less. They are written to and read from and can be used to store passwords, access keys or SQL connect strings.
  • Keys. These are written to the key vault but cannot be exported. They are used for encryption and hash generation. Even when the key is used, it can be configured not to leave the HSM and instead the cipher operations required are sent to the key vault service and the result returned.
  • Data. Sensitive pieces of information can also be stored in Azure Key Vault.

Image 2

When application secrets are centrally stored in Azure Key Vault, it’s easier to control their distribution. There’s no longer any need for application developers to store security information in their application, so they no longer need to make this information part of the code.

How Does It Work?

No-one (a user or an application) can get access to Azure Key Vault unless they have proper authentication and authorization. The identity of the caller is established through authentication. This is done via the Azure Active Directory. Authorization determines what operations the caller is allowed to carry out. Authorization can be done using role-based access control (RBAC) or Key Vault access policy.

Image 3

Access to a key vault requires proper authentication and authorization before a caller (user or application) can get access. Authentication establishes the identity of the caller, while authorization determines the operations that they are allowed to perform.

Azure Key Vault also allows you to segregate application secrets. You can restrict applications access only to the vault that you allow; for example, you can create a Key Vault for each specific application and its team of developers.

Image 4

What Kind of Operations Are Supported?

  • For keys: Create, Import, Get, List, Backup, Restore, Delete, Update, Sign, Verify, Wrap, Unwrap, Encrypt & Decrypt
  • For Secrets: Create, Update, Get, List, Delete
  • For Certificates: Create, Update Policy, Contacts, Import, Renewal, Update

How Is Azure Key Vault Managed?

Key Vault management is allowed via REST, CLI, PowerShell and Azure Resource Manager. All keys and secrets added to Azure Key Vault have their own URL. Applications can access the keys they need by using the URLs, so there’s no need to write code to protect the secret information. Key Vault also has logging features. This makes it possible to monitor when and who accessed the contents of the Key Vault. The access logs are saved into an Azure storage account.

Simplified Administration

Valuable data must be secured, but also must be highly available. Using Azure Key Vault simplifies a lot of the administration needed to secure secrets.

Image 5

  • It can scale up quickly when needed.
  • You can copy the contents of your key vault within a region and to another region to improve availability.
  • It can be easily accessed via the portal, Azure CLI and PowerShell.
  • Some tasks related to certificates can be automated.

Integration With Other Azure Services

Key Vault can be used to simplify Azure Data Encryption, the always encrypted functionality in Azure SQL Database. Key Vault can also integrate with storage accounts, log analytics and event hubs.


  • 10th November, 2018: Version 1


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Chief Technology Officer The DataWorks
United Kingdom United Kingdom
Allen is a consulting architect with a background in enterprise systems. His current obsessions are IoT, Big Data and Machine Learning. When not chained to his desk he can be found fixing broken things, playing music very badly or trying to shape things out of wood. He runs his own company specializing in systems architecture and scaling for big data and is involved in a number of technology startups.

Allen is a chartered engineer, a Fellow of the British Computing Society, and a Microsoft MVP. He writes for CodeProject, C-Sharp Corner and DZone. He currently completing a PhD in AI and is also a ball throwing slave for his dogs.

Comments and Discussions

QuestionKeyvault + Vsts + arm templates Pin
Sacha Barber10-Nov-18 12:11
MemberSacha Barber10-Nov-18 12:11 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.