L3. Securing Secrets and Keys with Azure Key Vault: Access, Firewalls & Defender for Key Vault

Vault vs. Managed HSM

Azure offers two Key Vault deployment models:

• Key Vault (standard/premium): multi-tenant HSM-backed or software-backed store for keys, secrets, and certificates
• Managed HSM: a single-tenant, dedicated FIPS 140-2 Level 3 validated HSM pool, used when compliance requires full control over the underlying hardware security module

Access Model: Access Policies vs. Azure RBAC

Key Vault data-plane access (getting/setting actual keys, secrets, certificates) can be controlled two ways:

Microsoft recommends the RBAC permission model for new vaults: it unifies management-plane and data-plane authorization under the same Azure RBAC system instead of a vault-specific access policy list, and integrates cleanly with Conditional Access and PIM for just-in-time elevation to sensitive vault roles.

Configuring the Key Vault Firewall

By default, a vault is reachable from the public internet. Locking it down involves:

• Private endpoint: gives the vault a private IP inside your VNet; the recommended approach for production
• Virtual network service endpoints: restrict access to specific subnets without a private IP
• Trusted Microsoft services: an allowlist bypass for specific first-party Azure services (like Azure Backup or Azure Resource Manager deployment) that need vault access even with the firewall otherwise set to deny public access
• Firewall default action: Deny, with explicit allowed IP ranges or the trusted-services bypass as the only exceptions

Managing Keys, Secrets, and Certificates

• Soft-delete (mandatory on all vaults) retains deleted items for a retention period, and purge protection prevents even a Owner/Contributor from permanently destroying them before that period elapses, protecting against a malicious or accidental permanent deletion
• Rotation policies on keys automate rotation on a schedule instead of relying on manual key rollover
• Certificate lifecycle management in Key Vault can auto-renew certificates issued by an integrated CA and notify configured contacts before expiration

Scanning for Secrets with Defender CSPM

Defender Cloud Security Posture Management (Defender CSPM) includes agentless scanning that inspects VM disks and containers for plaintext secrets, keys, and credentials left in code or config files, not just what's properly stored in Key Vault. Findings surface as recommendations pointing to exactly which VM and file path contains the exposed secret, closing the gap where developers hardcode a credential instead of retrieving it from the vault.

Defender for Key Vault

Defender for Key Vault is the workload protection plan specific to Key Vault. It analyzes the operations performed against your vaults and alerts on anomalous patterns such as:

• Access from a Tor exit node or another unusual/suspicious IP
• An unusual volume of secret retrievals in a short window (a sign of automated exfiltration)
• Access patterns inconsistent with the calling application's normal behavior

These alerts surface in Defender for Cloud alongside other workload protection alerts, giving a unified view of vault-specific threats. Exam tip: SC-500 draws a clear line between *preventive* controls (RBAC data-plane model, firewall, private endpoint, soft-delete/purge protection) and *detective* controls (Defender for Key Vault alerting on anomalous access, Defender CSPM finding hardcoded secrets outside the vault entirely).