Azure Key Vault: Secrets, Keys, Certificates, Rotation, and Private Access

Azure Key Vault protects secrets, cryptographic keys, and certificates behind Entra authentication, authorization, logging, recovery, and network controls. Store a password as a secret, use a key for cryptographic operations without exporting its private material, and use certificate objects for certificate lifecycle. Applications should access the vault with managed identity.

Lab: 35 minutes · Cost: operations and premium/HSM choices can be billable · Creates: vault and one dummy secret · Never use: a real password in this lab.

Which object type should you use?

Do not store large files or general configuration in Key Vault. Store only sensitive values and cryptographic material that need its controls.

How can you create a vault and a training secret?

Ways to build

Choose the Azure tool you want to use. The underlying resource stays the same.

Azure portalAzure CLIAzure PowerShell

Azure portal

Search Key vaults → Create. Choose subscription, resource group, globally unique name, region, pricing tier, recovery settings, authorization model, and network access. Prefer Azure RBAC for consistent authorization. After creation, assign Key Vault Secrets Officer at the narrow vault scope and use Objects → Secrets → Generate/Import for the harmless DemoMessage value.

Azure CLI

bash

WrapCopy

AZURE_RG="rg-northstar-dev-001" AZURE_LOCATION="eastus" VAULT_NAME="kv-northstar-REPLACE_UNIQUE" az keyvault create \ --name "$VAULT_NAME" \ --resource-group "$AZURE_RG" \ --location "$AZURE_LOCATION" \ --enable-rbac-authorization true \ --enable-purge-protection true \ --retention-days 90

Grant your learning identity Key Vault Secrets Officer at the vault scope only if you are permitted to manage secret values. Wait for RBAC propagation, then create a harmless secret without putting it directly in shell history. One approach is to load it from a protected local input or file. For a non-sensitive training value only:

bash

WrapCopy

az keyvault secret set \ --vault-name "$VAULT_NAME" \ --name DemoMessage \ --value "not-a-real-secret"

Never use that inline pattern for a real secret because command history and process inspection can expose it.

Azure PowerShell

powershell

WrapCopy

$Demo Value = Convert To-Secure String "not-a-real-secret" -As Plain Text -Force Set-Az Key Vault Secret -Vault Name "kv-northstar-REPLACE_UNIQUE" -Name "Demo Message" -Secret Value $Demo Value

How does an application read a secret without credentials?

1. Enable managed identity on the app resource.
2. Assign Key Vault Secrets User at the vault or secret scope.
3. Use DefaultAzureCredential in the Azure Identity SDK.
4. Request the secret URI or name.
5. Cache the value carefully and handle rotation.

Python example:

The same code can use a developer's Azure login locally and managed identity in Azure. Production authorization still depends on explicit RBAC.

How do Bicep and Terraform deploy a vault safely?

Deploy the vault, private endpoint, private DNS link, managed identity, and role assignment as code. Do not pass secret values in Bicep parameters or Terraform variables unless the delivery mechanism and state handling are explicitly secured. Terraform state can contain sensitive values even when CLI output hides them.

What do soft delete and purge protection change?

Soft delete retains a deleted vault or object for recovery. Purge protection prevents permanent purge until retention expires. These protections defend against accidents and malicious deletion, but they affect name reuse and teardown. A lab vault with purge protection may keep its globally unique name unavailable until recovery retention ends.

How should rotation work?

Prefer identities and tokens that do not require stored passwords. When a secret remains necessary:

1. Create a new version.
2. Update or let clients discover the current version.
3. Verify all clients use it.
4. Disable the old version.
5. Delete it only after the rollback window.

Use Event Grid, Functions, automation, or supported rotation integrations. Monitor expiry well before it becomes an outage.

Verify and clean up

Delete the dummy secret and vault or resource group. Remember purge protection may retain the deleted vault until the retention window ends.

Official references

• Azure Key Vault overview
• Azure RBAC for Key Vault
• Key Vault security guidance
• Key Vault private link