Design identity, governance, and monitoring solutions · Topic 4 of 6
Secrets, Certificates and Keys with Key Vault
AZ-305 secrets design: choose Key Vault Standard, Premium or Managed HSM, use soft delete and purge protection, RBAC access, and customer managed keys.
- 5 min
- Standard stores software keys, Premium adds HSM backed keys, and Managed HSM is single tenant and keys only.
- Azure RBAC is the recommended access model. Access policies are legacy and cannot use PIM.
- Soft delete is always on with 7 to 90 days retention set at creation. Purge protection is optional and irreversible.
What it is
Azure Key Vault stores secrets (passwords, connection strings), keys (cryptographic keys) and certificates securely, with access control and audit logging. Managed HSM is a higher assurance, single tenant key service. The architect chooses the right vault type, the access model, the protection against deletion and how apps read secrets without holding credentials.
How it works
Choosing the vault type
| Standard | Premium | Managed HSM | |
|---|---|---|---|
| Tenancy | Multitenant | Multitenant | Single tenant |
| Stores | Secrets, certificates, software protected keys | Adds HSM backed keys | HSM backed keys only |
| Assurance | Software keys | HSMs validated to FIPS 140 Level 3 | FIPS 140 Level 3, customer owned security domain |
| Use | Most apps | Compliance that needs HSM protected keys | Highest control, regulated workloads, customer owned root of trust |
Use Standard for ordinary secrets. Use Premium when a rule requires keys in an HSM. Use Managed HSM for a dedicated HSM cluster where you control the security domain (the root of trust), or for Customer Key scenarios.
Access model
Key Vault has two authorization systems.
| Azure RBAC | Access policies (legacy) | |
|---|---|---|
| Status | Recommended, and the default for new vaults on current API versions | Legacy |
| Granularity | Per vault, resource group, subscription, and some object scope | Whole vault only |
| Security | Only Owner and User Access Administrator can grant access | Anyone with vault write rights can give themselves data access |
| PIM | Supported | Not supported |
Use built in roles such as Key Vault Secrets User (read secrets), Key Vault Secrets Officer, Key Vault Crypto User and Key Vault Administrator. Switching a vault to RBAC invalidates its access policies, so assign equivalent roles first. If a vault is still in access policy mode, RBAC role assignments are ignored. For real isolation, use one vault per application and per environment.
Apps should reach the vault with a managed identity, so there is no credential to store. Use Key Vault references in App Service or Functions to inject secrets into settings. Use private endpoints and the vault firewall to remove public access.
Soft delete and purge protection
| Feature | Behaviour |
|---|---|
| Soft delete | Always on for new vaults and cannot be disabled. A deleted vault or object is recoverable for 7 to 90 days (default 90). The period is set at creation and cannot be changed later |
| Purge protection | Optional, and needs soft delete. When on, nothing can be purged until the retention period ends, even by Microsoft. It cannot be turned off once enabled |
Many services that use customer managed keys, such as Storage, require purge protection to prevent data loss. Managed HSM keeps billing a soft deleted HSM at the full hourly rate until it is purged.
Customer managed keys and rotation
Azure services encrypt data at rest with Microsoft managed keys by default. When a requirement says the customer controls the key, use customer managed keys (CMK) stored in Key Vault or Managed HSM. For Storage, SQL TDE, disks and Cosmos DB, assign the service a managed identity with the Crypto Service Encryption role, and enable automatic key rotation. For certificates, Key Vault can auto renew with integrated certificate authorities and trigger Event Grid events before expiry.
Choosing quickly
| Requirement | Answer |
|---|---|
| Web app needs a database password, with no credentials in config | Key Vault, a managed identity, and a Key Vault reference |
| Keys must be in a FIPS 140 Level 3 HSM, shared service is fine | Key Vault Premium |
| Dedicated HSM and customer owned security domain | Managed HSM |
| Prevent an admin from permanently deleting keys for 90 days | Purge protection |
| Separate secrets per environment and team | One vault per app and environment with RBAC |
A worked scenario
A bank needs to encrypt storage with its own keys held in HSMs, and wants the keys protected from accidental deletion. The architect chooses Managed HSM with purge protection and a 90 day retention, grants the storage account's managed identity the encryption role, enables key rotation, and locks the vault behind a private endpoint. Application secrets live in separate Standard vaults, one per application, using RBAC and Key Vault references.
What to remember for the exam
- Standard stores software keys, Premium adds HSM backed keys, and Managed HSM is single tenant and keys only.
- Azure RBAC is the recommended access model. Access policies are legacy and cannot use PIM.
- Soft delete is always on with 7 to 90 days retention set at creation. Purge protection is optional and irreversible.
- Apps should use managed identities and Key Vault references, not stored credentials.
- Customer managed keys need a vault, an identity and purge protection for many services.
Switching a vault from access policies to RBAC removes the access policy permissions. Assign roles first.
How the exam asks about this
- "Keys must be stored in an HSM that only the customer controls." Managed HSM.
- "Prevent permanent deletion of keys even by administrators." Purge protection.
- "An app needs a secret with no stored credentials." A managed identity with Key Vault Secrets User.
- "Rotate customer managed keys automatically." Key Vault automatic key rotation with CMK.
Common mistakes
Keeping access policies on new vaults. RBAC is recommended.
Enabling purge protection without planning. It cannot be disabled.
One shared vault for every application. Access is whole vault.
Choosing Managed HSM when Premium meets the need. It costs more.
Check yourself
What range can soft delete retention take?
7 to 90 days, set at creation.
Which Key Vault option is single tenant and keys only?
Managed HSM.
What is the recommended access model?
Azure RBAC.
Topic 4 of 6 in Design identity, governance, and monitoring solutions
Test yourself on Design identity, governance, and monitoring solutions
The full Microsoft AZ-305 question bank has 755 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.