Azure Key Vault: AZ-500 Secrets, Keys & Certificates

Secrets vs Keys vs Certificates

Key difference: When you use a Key, the cryptographic operation happens inside Key Vault. Your application sends data to Key Vault and receives the result: the key material never leaves. With a Secret, the value is returned to your application.

Access Models: Vault Access Policies vs RBAC

Azure RBAC roles for Key Vault: Key Vault Secrets Officer (read/write secrets), Key Vault Secrets User (read-only), Key Vault Administrator (full control), Key Vault Crypto User (use keys for operations), Key Vault Crypto Officer (manage keys). Exam tip: Azure RBAC and vault access policies cannot both be enabled on the same vault: you must choose one.

Soft Delete and Purge Protection

• Soft delete: Deleted objects are retained for 7 to 90 days (configurable). They can be recovered. Enabled by default on new vaults.
• Purge protection: Prevents hard deletion during the soft-delete retention period. Once enabled, it cannot be disabled. Required for vaults used with Customer-Managed Keys (CMK).

Premium Tier: HSM-Backed Keys

Premium Key Vault uses FIPS 140-2 Level 2 hardware security modules to protect key material. Key operations never leave the HSM. Use for regulatory requirements mandating hardware key protection.