---
source: https://iinventedlight.com/library/notes/azure-key-vault.md
title: "Azure Key Vault: storing secrets, keys and certificates"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "CC BY 4.0 (MicrosoftDocs/azure-docs); prose restates or closely paraphrases cited source lines"
license_family: azure-docs-ccby
rule_check: "needs rule check (family not in auto-publish rule; check.mjs auto-approves only usgov and arxiv-ccby)"
attribution: "Summary by iinventedlight (AI-assisted). Sources: Microsoft Learn (Azure docs), Azure Key Vault Overview - Azure Key Vault, CC BY 4.0 (MicrosoftDocs/azure-docs); Microsoft Learn (Azure docs), What is Azure Key Vault?, CC BY 4.0 (MicrosoftDocs/azure-docs)."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-04
status: published
checked_on: 2026-11-04
as_of: 2026-11-04
confidence: medium
untested: "No code was run for this note; only the fetched documentation pages were read."
category: coding-references
topic_area: "code-ai-eng: Azure"
tags: ['azure', 'key-vault', 'secrets-management']
sources:
  - id: S1
    title: "Azure Key Vault Overview - Azure Key Vault"
    publisher: Microsoft Learn (Azure docs)
    url: https://learn.microsoft.com/en-us/azure/key-vault/general/overview
    accessed: 2026-11-04
    license: "CC BY 4.0 (MicrosoftDocs/azure-docs)"
  - id: S2
    title: "What is Azure Key Vault?"
    publisher: Microsoft Learn (Azure docs)
    url: https://learn.microsoft.com/en-us/azure/key-vault/general/basic-concepts
    accessed: 2026-11-04
    license: "CC BY 4.0 (MicrosoftDocs/azure-docs)"
---
# Azure Key Vault: storing secrets, keys and certificates

**Answer:** Azure Key Vault is a cloud service for securely storing and accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, or cryptographic keys. (S2)

## What it manages

- Azure Key Vault makes it easy to create and control the encryption keys used to encrypt your data. (S1)
- Azure Key Vault lets you easily provision, manage, and deploy public and private TLS/SSL certificates for use with Azure and your internal connected resources. (S1)
- Key Vault service supports two types of containers: vaults and Managed HSM pools. (S2)
- Vaults support storing software and HSM-backed keys, secrets, and certificates. (S2)

## Why centralize secrets

- Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. (S1)
- When application developers use Key Vault, they no longer need to store security information in their application. (S1)
- Instead of storing a connection string in the app's code, you can store it securely in Key Vault. (S1)
- Your applications can securely access the information they need by using URIs, which allow them to retrieve specific versions of a secret. (S1)

## Roles

- A vault owner can create a key vault and gain full access and control over it, and can also set up auditing to log who accesses secrets and keys. (S2)
- A vault consumer can perform actions on the assets inside the key vault when the vault owner grants the consumer access. (S2)

## Claims
- id: C1
  claim: Key Vault is a cloud service for storing and accessing secrets.
  source: S2
  evidence: "Azure Key Vault is a cloud service for securely storing and accessing secrets."
- id: C2
  claim: Key Vault supports vaults and Managed HSM pools.
  source: S2
  evidence: "Key Vault service supports two types of containers: vaults and Managed HSM pools."
- id: C3
  claim: Centralizing secrets lets you control their distribution.
  source: S1
  evidence: "Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution."
- id: C4
  claim: Applications access secrets by URIs.
  source: S1
  evidence: "Your applications can securely access the information they need by using URIs."

## Sources
- [S1] Azure Key Vault Overview - Azure Key Vault. Microsoft Learn (Azure docs). https://learn.microsoft.com/en-us/azure/key-vault/general/overview . License: CC BY 4.0 (MicrosoftDocs/azure-docs). Accessed 2026-11-04.
- [S2] What is Azure Key Vault?. Microsoft Learn (Azure docs). https://learn.microsoft.com/en-us/azure/key-vault/general/basic-concepts . License: CC BY 4.0 (MicrosoftDocs/azure-docs). Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).