What is Azure Key Vault? A plain-English explainer
Azure Key Vault is a managed Azure service for securely storing and controlling access to three related things: secrets (such as database passwords and API keys), encryption keys, and certificates. Rather than an application hard-coding a password or a signing key, it fetches the current value from Key Vault at runtime, and Azure enforces who and what is allowed to read it. Centralising all three in one vault means there is a single place to secure, rotate and audit them, instead of every application inventing its own storage. Key Vault is one of the first services most people meet once they move past “just make it work” and start asking “where should this credential actually live”. Here is what it does, why that matters, and how it lines up against the equivalent AWS services.
What Key Vault actually stores
A vault can hold three distinct kinds of content. Secrets are arbitrary values an application needs but should not expose — database connection strings, API keys, tokens. Keys are cryptographic keys used to encrypt and decrypt data, which Key Vault can also use directly to perform cryptographic operations without ever releasing the raw key material. Certificates are TLS/SSL certificates, which Key Vault can manage the lifecycle of, including renewal.
Access to all three is governed centrally: you decide which users, groups or applications can read, write or manage items in a given vault, and Key Vault enforces that boundary on every request rather than leaving it up to each application to check.
Why keeping secrets out of code matters
A credential hard-coded into source or left in a plaintext config file is a credential exposed to everyone who can read that source or that file — and, if it is ever committed to version control, effectively permanent even after deletion. Key Vault gives applications a single, access-controlled place to fetch a credential from at the moment they need it, so removing or rotating a credential is one change in the vault rather than a hunt through deployed code.
Our what-is-identity-and-access-management explainer covers the broader concept of controlling who can do what; Key Vault applies that same principle specifically to secrets, keys and certificates. And because keys and secrets held in the vault are themselves protected using encryption, our what-is-encryption-in-the-cloud explainer is useful background on what that protection actually means.
Key Vault versus AWS KMS and Secrets Manager
Azure does not split this into two services the way AWS does. AWS separates key management (AWS KMS, which manages encryption keys) from secret storage (AWS Secrets Manager, which manages credentials like passwords). Azure Key Vault broadly covers both jobs in one service — plus certificate management, which neither AWS service handles directly.
That difference is worth knowing if you work across both clouds, or you are studying one platform having already learned the other: the underlying problems — protect encryption keys, protect application credentials — are the same, but Azure’s answer is one vault where AWS’s is two purpose-built services.
Common uses
Key Vault typically shows up wherever an Azure application or team needs to protect something sensitive:
- Application secrets — database connection strings and API keys retrieved at runtime rather than stored in config.
- Encryption key management — keys used to protect data in Azure services, without exposing the raw key material to applications.
- Certificate lifecycle — issuing, storing and renewing the TLS certificates a web application or API relies on.
- Access auditing — a central point to see who accessed which secret, key or certificate, and when.
How pricing works, in one line
Key Vault follows the same consumption model as most managed cloud services: you pay for what you use — broadly, the operations performed against the vault and any premium hardware-backed key protection you choose — rather than a fixed upfront cost. Exact rates and tiers change over time, so Microsoft’s own Key Vault pricing page is the accurate source rather than a number repeated here.
Where Key Vault appears in certification study
Key Vault is core material on Microsoft Certified: Azure Administrator Associate (AZ-104), which expects you to know how to create a vault, control access to it, and use it to store secrets and manage certificates. It is introduced conceptually on Microsoft Certified: Azure Fundamentals (AZ-900), and the underlying secure-storage and least-privilege ideas it embodies are also relevant background for ISC2 Certified in Cybersecurity. Our /revision study library covers that depth lesson by lesson.
Original practice questions, timed mock exams and revision notes. No card, nothing to pay.