Azure Key Vault: The Complete Introduction

Explore why Azure Key Vault centralizes secrets, keys, and certificates, and how it protects sensitive data from leaks with access controls and optional hardware or software protections.

Centralize your application secrets in secure, centralized storage to reduce leakage and enable runtime access, while regional replication and Azure AD with RBAC and access policies ensure backend app availability.

Discover how Azure Key Vault protects secrets, cryptographic keys, and X.509 certificates, enabling encrypt, decrypt, sign, and verify operations while enforcing access via Azure AD and roles.

Explore Azure Key Vault fundamentals by understanding its purpose, Key Vault objects, and hands-on practice through creating a Key Vault and applying concepts in the next module.

Learn to create an Azure key vault using portal, CLI, or az PowerShell, with step-by-step examples and prerequisites like an Azure subscription, cost considerations, and installing the az PowerShell module.

Sign into the Azure portal and create a key vault with a globally unique name; choose standard tier with 7 days soft delete, as disk encryption uses vault keys.

Create two key vaults, one from the Azure portal and one with PowerShell, then compare interfaces; note that attributes are consistent across portal and PowerShell despite naming differences.

Explore the secret keys and certificates stored in a key vault, dive into their properties and use cases, and learn the differences with hands-on practice.

Store and manage application secrets in Azure Key Vault as name-value pairs with unique secret names, encrypted storage, and runtime retrieval.

Create and manage secrets in Azure Key Vault using PowerShell, including setting, versioning, expiration, not before, content type, and tags, then retrieve or remove secrets via portal or script.

Learn how Azure Key Vault stores asymmetric keys (RSA and EC) as JSON Web Key objects, with software or hardware protection, and supports sign, verify, encrypt, decrypt, wrap, and unwrap.

Demonstrates creating a key in a key vault, configuring software protection, expiration and activation times, restricting operations to encrypt and decrypt, and viewing versions and the public key.

Explore how digital certificates link a public key to its owner through a certificate authority, enabling verification of identity and secure data exchange in Azure Key Vault.

Demonstrates creating and managing a self-signed certificate in Azure Key Vault, including defining a certificate policy, provisioning via commands, and retrieving the certificate, key, and secret.

This module covers secrets, keys, and certificates in Azure Key Vault, including secret expiration, key operations, and certificate life cycle with auto-renewal.

Explore protecting application secrets like database connection strings with key vault techniques. Sign messages for integrity and encrypt for confidentiality using symmetric keys wrapped by asymmetric keys.

Explore storing secrets in Azure Key Vault, access them from an Azure Function at runtime, and return the secret via a get request tested locally with Postman.

Sign a message with a signing key stored in Azure Key Vault, hash with SHA-256, and return hex signature; verify the signature with the public key to ensure message integrity.

Encrypt messages with a symmetric key, then wrap the key using RSA and store it in a Key Vault secret. Decrypt by unwrapping the key and decrypting the ciphertext.

Azure disk encryption with key vault protects Windows and Linux VM disks by using a VM extension to wrap the symmetric key with key encryption key stored in key vault.

Explore programmatic access to keys and secrets, sign and verify messages with RSA, and encrypt data using symmetric wrap, while noting production-grade error checks and upcoming access-management topics.

Secure access to Azure Key Vault by separating authorization from management and data, and implement role-based access control to grant users access based on their role.

Authenticate users and applications via Azure Active Directory, enforce authorization with role-based access control on the management plane, and manage secret keys and certificates on the data plane.

Analyze how the Azure management plane uses role-based access control to authorize access to resources. Learn about security principals, role definitions, scopes, built-in roles (owner, contributor, reader), and custom roles.

Configures role based access control for Azure Key Vault with built-in roles (owner, contributor, reader). Assigns roles to users and contrasts management plane permissions with data plane access.

Create a custom role in Azure Key Vault using the portal by cloning a reader and adding permissions to read or update access policies, then assign it to a user.

Compare management and dataplane to clarify authorization scopes. Build and customize rules for management plan, assign a built-in role, and extend a rule with permissions, preparing for data plane authorization.

Configure access policies to grant permissions for secrets, keys, and certificates to users and applications, then apply managed identity and network restrictions to securely control access.

Understand how old access policies grant permissions for keys, secrets, and certificates, why policies apply to entire keyboards, and why separate keyboards prevent two apps from seeing each other's secrets.

Configure an Azure Key Vault access policy by assigning secrets, keys, and certificates permissions to a user or object ID, then validate least-privilege access in the portal.

Learn how to use managed identities to grant applications like function apps access to Azure Key Vault without user credentials, using system assigned and user assigned identities.

Assign a system or user assigned managed identity to the function app, grant it access to secrets and cryptographic operations in Azure Key Vault, and verify access post-deployment.

Configure network restrictions for Azure key vault to limit data plane access to selected networks or virtual networks and specific source IPs, and assess impact on services like disk encryption.

Explore data plane authorization with access policies, configure system and user assigned managed identities, grant a function access to the keyboard, and implement firewall and ip restrictions for security.

Enable logging to monitor who accesses secrets with audit events and track health metrics, then archive logs to storage or stream to Event Hub via Log Analytics and alerts.

Enable logging for key vault by configuring diagnostic settings in portal, sending events to log analytics and a storage account. Create log analytics workspace and storage account to complete setup.

Configure diagnostic settings to archive Azure Key Vault logs to a storage account and log analytics workspace, and learn how events are captured in JSON logs.

Open the log analytics workspace to view metrics and audit events in the key word analytics solution, then use built-in query suggestions to create, save, and export queries.

Identify who accessed your keyboard, log keyboard access events and metrics, store logs in a storage account for archival auditing and performance analysis, and forward logs to events.

Choose a Key Vault service tier at creation, standard or premium. Only premium offers HSM protected keys, with storage and transaction charges varying by region.

Learn Azure Key Vault concepts, including secrets, keys, and certificates, and how authentication via Azure Active Directory and RBAC controls access on management and data planes.