Manage Identity, Access, and Governance · Topic 2 of 3
Securing Secrets and Keys with Azure Key Vault
SC-500 Key Vault: deployment and settings, RBAC versus access policies, firewall and private access, keys, secrets and certificates, and Defender protection.
- 4 min
- Premium SKU for HSM-protected keys; Managed HSM for dedicated single-tenant HSMs.
- Prefer the Azure RBAC permission model; separate management and data plane access.
- Firewall, private endpoints and disabled public access secure the network path.
What it is
Azure Key Vault stores secrets (passwords, connection strings), keys (for encryption and signing) and certificates. SC-500 tests how to deploy and configure a vault, control who can reach and use it, manage its contents, find secrets left elsewhere, and detect threats against it.
How it works
Deploying and configuring a vault
| Setting | Purpose |
|---|---|
| SKU | Standard, or Premium for keys protected by hardware security modules (HSMs) |
| Soft delete | On by default and can't be turned off; deleted vaults and objects stay recoverable for 7 to 90 days (default 90), a period set only at creation |
| Purge protection | Off by default; prevents permanent deletion until the retention period ends; required by services such as Storage that use customer-managed keys |
| Permission model | Azure RBAC (recommended, and the default for new vaults from API version 2026-02-01) or legacy vault access policies |
| Diagnostic settings | Send audit logs to Log Analytics, storage or Event Hubs |
Azure Key Vault Managed HSM is a separate, single-tenant service for keys in dedicated HSMs.
Controlling access
| Model | How it works |
|---|---|
| Azure RBAC | Built-in roles such as Key Vault Administrator, Key Vault Secrets User, Key Vault Crypto User and Key Vault Certificates Officer; assign at vault scope, or on a single key, secret or certificate only for limited cases such as one secret shared between apps |
| Access policies | Per-vault list of identities and their key, secret and certificate permissions |
Separate management plane access (manage the vault resource) from data plane access (read or use secrets and keys). Under the RBAC model, Contributor and Key Vault Contributor can't read secrets. Under the access policy model, a Contributor can grant itself data access by editing access policies, which is one reason RBAC is preferred.
Network security
- The Key Vault firewall allows only selected virtual networks and IP ranges.
- Private endpoints give the vault a private IP in your virtual network; then disable public network access.
- The allow trusted Microsoft services option lets specific Azure services reach the vault through the firewall.
Managing keys, secrets and certificates
- Every object has versions; set expiration and activation dates.
- Keys can use a rotation policy for automatic rotation.
- Certificates can be created by Key Vault with a supported certificate authority or imported, and can auto-renew.
- Use Key Vault keys as customer-managed keys for services such as Storage and SQL.
Finding secrets elsewhere
Defender CSPM scans agentlessly for exposed secrets on virtual machines (also included in Defender for Servers Plan 2), in cloud deployment resources and in Azure DevOps code repositories. Findings appear as recommendations, in the inventory, in cloud security explorer and in attack paths; remove the secrets and store them in Key Vault.
Defender for Key Vault
Microsoft Defender for Key Vault detects unusual and potentially harmful attempts to access or exploit key vaults, such as access from a suspicious IP address, and raises security alerts in Defender for Cloud. Respond by restricting the firewall, removing the principal's access and rotating the affected secrets.
"Developers manage the vault but must not read production secrets" points to Azure RBAC with separate management and data roles.
How the exam asks about this
- "Only an app's identity may read one specific secret." Azure RBAC role Key Vault Secrets User scoped to that secret.
- "The vault must not be reachable from the internet." Private endpoint plus disabled public network access.
- "Prevent a deleted key being permanently removed." Purge protection.
What to remember for the exam
- Premium SKU for HSM-protected keys; Managed HSM for dedicated single-tenant HSMs.
- Prefer the Azure RBAC permission model; separate management and data plane access.
- Firewall, private endpoints and disabled public access secure the network path.
- Versions, expiration, key rotation policies, certificate auto-renewal.
- Defender CSPM finds exposed secrets; Defender for Key Vault detects suspicious access.
Soft delete alone still allows a principal with purge permission (for example the Key Vault Purge Operator role) to purge an object. Purge protection blocks that until the retention period ends.
Common mistakes
Granting Owner or Contributor to read secrets. Use a data plane role.
Leaving public access on after adding a private endpoint. Disable it.
Skipping purge protection for customer-managed keys. Some services require it.
Check yourself
Which Key Vault role lets an app read secret values under Azure RBAC?
Key Vault Secrets User.
What does purge protection add to soft delete?
It prevents permanent deletion of the vault or its objects until the retention period ends.
What does Microsoft Defender for Key Vault do?
It detects unusual or potentially harmful access to the vault and raises security alerts.
Topic 2 of 3 in Manage Identity, Access, and Governance
Test yourself on Manage Identity, Access, and Governance
The full Microsoft SC-500 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.