Azure Key Vault for Enterprise: Secure Secrets, Keys, and Certificates at Scale

Overview

Azure Key Vault is a managed service for storing and controlling access to secrets, cryptographic keys, and X.509 certificates. Enterprises use it to remove credentials from code, standardize key management, integrate with Azure services, and support compliance requirements such as separation of duties, auditability, and key rotation.

Key Vault has two main service families: Vaults for secrets, software-protected keys, and certificates, and Managed HSM for FIPS 140-2 Level 3 validated hardware-backed key operations. Typical use cases include application secret storage, customer-managed keys for Azure services, TLS certificate lifecycle management, and centralized cryptographic control for regulated workloads.

Architecture

Core components include:

• Vault or Managed HSM: the secure boundary for data objects.
• Azure AD / Microsoft Entra ID: identity provider for authentication.
• RBAC or access policies: authorization model controlling data-plane access.
• Private Endpoint: private network path to the vault.
• Diagnostic settings: export audit logs to Log Analytics, Event Hub, or Storage.
• Consumers: Azure App Service, AKS, Functions, VMs, pipelines, and external apps.

Deployment models:

• Public endpoint with firewall restrictions for controlled internet-based access.
• Private Link-only access for high-security enterprise landing zones.
• Hub-spoke hybrid model where on-premises apps reach Key Vault over ExpressRoute or VPN.

Data flow:

1. A workload authenticates with a managed identity or service principal.
2. Microsoft Entra ID issues a token for https://vault.azure.net.
3. The workload calls the Key Vault data plane.
4. Authorization is evaluated via Azure RBAC or legacy access policies.
5. Secret retrieval, key operation, or certificate action is logged to Azure Monitor.

Implementation Guide

1. Create a resource group and Key Vault.

az group create --name rg-sec-core-prod --location westeurope
az keyvault create --name kv-core-prod-001 --resource-group rg-sec-core-prod --location westeurope --enable-rbac-authorization true --retention-days 90 --enable-purge-protection true --public-network-access Disabled

1. Create a private endpoint and DNS integration.

az network private-endpoint create --name pe-kv-core-prod --resource-group rg-sec-core-prod --vnet-name vnet-hub-prod --subnet snet-private-endpoints --private-connection-resource-id $(az keyvault show -n kv-core-prod-001 -g rg-sec-core-prod --query id -o tsv) --group-id vault --connection-name pe-kv-core-prod-conn
az network private-dns zone create -g rg-sec-core-prod -n privatelink.vaultcore.azure.net

1. Assign RBAC to a managed identity.

PRINCIPAL_ID=$(az identity show -g rg-app-prod -n id-app-payments-prod --query principalId -o tsv)
KV_ID=$(az keyvault show -n kv-core-prod-001 -g rg-sec-core-prod --query id -o tsv)
az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "Key Vault Secrets User" --scope $KV_ID

1. Store and retrieve a secret.

az keyvault secret set --vault-name kv-core-prod-001 --name SqlConnectionString --value "Server=tcp:sql-prod.database.windows.net,1433;Database=appdb;Authentication=Active Directory Managed Identity;"
az keyvault secret show --vault-name kv-core-prod-001 --name SqlConnectionString

1. Enable diagnostics.

KV_ID=$(az keyvault show -n kv-core-prod-001 -g rg-sec-core-prod --query id -o tsv)
LAW_ID=$(az monitor log-analytics workspace show -g rg-monitoring-prod -n law-sec-prod --query id -o tsv)
az monitor diagnostic-settings create --name kv-audit --resource $KV_ID --workspace $LAW_ID --logs '[{"category":"AuditEvent","enabled":true}]' --metrics '[{"category":"AllMetrics","enabled":true}]'

Code Examples

1. Bash: certificate import

az keyvault certificate import --vault-name kv-core-prod-001 --name api-contoso-com --file api-contoso-com.pfx --password 'Str0ngPfxPass!'

2. YAML: Kubernetes CSI Secret Store

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: kv-payments-prod
  namespace: payments
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    useVMManagedIdentity: "true"
    userAssignedIdentityID: "11111111-2222-3333-4444-555555555555"
    keyvaultName: "kv-core-prod-001"
    tenantId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
    objects: |
      array:
        - |
          objectName: SqlConnectionString
          objectType: secret

3. Python: retrieve a secret with managed identity

from azure.identity import ManagedIdentityCredential
from azure.keyvault.secrets import SecretClient
credential = ManagedIdentityCredential()
client = SecretClient(vault_url="https://kv-core-prod-001.vault.azure.net/", credential=credential)
secret = client.get_secret("SqlConnectionString")
print(secret.value)

Security Hardening

• Prefer Azure RBAC over legacy access policies for consistent governance.
• Enable soft delete and purge protection on every production vault.
• Disable public access and use Private Endpoints with private DNS.
• Use Managed HSM for highly regulated key custody and signing workloads.
• Restrict secret access by workload identity, not by shared service principals.
• Rotate secrets and certificates automatically; monitor SecretNearExpiry and certificate expiration.
• Export audit logs and alert on unusual patterns such as repeated SecretGet failures or access from unexpected subnets.
• Use customer-managed keys carefully: protect the key vault itself with backup, break-glass access, and documented recovery procedures.

Comparison

Troubleshooting

Error 1: Forbidden access

Log sample:

Code="Forbidden" Message="The user, group or application 'appid=3f5c1c2d-9d1e-4a6e-9b3f-2d7f8d1a1234;oid=9e0b9b20-6d88-4f5e-a1f7-2a1d6c4b5678' does not have secrets get permission on key vault 'kv-core-prod-001'."

Fix: Verify the identity token target, confirm RBAC assignment at vault scope, and wait for role propagation.

Error 2: Private DNS resolution failure

Log sample:

requests.exceptions.ConnectionError: HTTPSConnectionPool(host='kv-core-prod-001.vault.azure.net', port=443): Max retries exceeded with url: /secrets/SqlConnectionString/?api-version=7.4 (Caused by NameResolutionError("Failed to resolve 'kv-core-prod-001.vault.azure.net'"))

Fix: Link privatelink.vaultcore.azure.net to the VNet, confirm A record creation, and validate DNS forwarders for hybrid networks.

Error 3: Soft-deleted vault name conflict

Log sample:

(Conflict) Vault name 'kv-core-prod-001' is currently in a deleted but recoverable state.
Code: Conflict

Fix: Recover or purge the deleted vault before recreating it: az keyvault recover --name kv-core-prod-001 or purge if policy allows.

Best Practices

Do

• Use one vault per application boundary or environment tier, such as prod, nonprod, and shared.
• Use managed identities for App Service, AKS, and Functions.
• Enable diagnostics and send logs to a central SIEM.
• Separate key administrators from secret consumers.

Don't

• Do not store application configuration that is not sensitive in Key Vault; use App Configuration where appropriate.
• Do not grant Key Vault Administrator broadly to DevOps teams.
• Do not expose vaults publicly unless there is a justified exception.
• Do not hardcode secret versions unless rollback control explicitly requires it.