Key Vault & Managed HSM
Standard vs Premium · Managed HSM · Cloud HSM · RBAC · Soft delete · Purge protection
Practice questions for this topic →
Pick the tier
| Option | Keys protected by | Tenancy | Pick when… |
|---|---|---|---|
| Key Vault Standard | Software | Multitenant | Secrets, certificates, software keys |
| Key Vault Premium | HSM-backed keys (FIPS 140-2 Level 2) | Multitenant HSMs | HSM protection at low cost |
| Managed HSM | Dedicated HSM pool (FIPS 140-2 Level 3) | Single tenant; you control the security domain | Single-tenant HSM with full key control |
| Azure Cloud HSM | Customer-owned cluster of three HSM nodes (FIPS 140-3 Level 3), PKCS#11 and more | Single tenant, customer-administered | Lift-and-shift HSM apps; successor to Azure Dedicated HSM |
| Azure Dedicated HSM (retiring) | Thales Luna appliances (FIPS 140-2 Level 3) | Single tenant | Retiring: full support until Jul 31, 2028, no new onboardings. Existing key material can't be migrated, so create new keys |
Protection features
| Feature | Behavior |
|---|---|
| Soft delete | Deleted objects recoverable 7–90 days (on by default; can't be disabled) |
| Purge protection | Nobody can purge before retention ends; once enabled it can't be turned off (required for customer-managed keys) |
| RBAC model | Recommended; default for new vaults from API 2026-02-01; only Owner and User Access Administrator can grant access |
| Access policies (legacy) | Anyone with Contributor or vault write can grant themselves data access |
| Private endpoint + firewall | Disable public access |
Managed HSM recovery
- Soft delete can't be turned off and retention (7–90 days, default 90) is fixed at creation. A soft-deleted HSM keeps billing hourly until purged and its name can't be reused until then.
- Purge and recover soft-deleted keys: Managed HSM Crypto Officer; list them: Crypto User; manage HSMs: Managed HSM Contributor.
Exam Tips
Tick each tip once you can answer it without looking.
“Prevent a malicious admin from permanently deleting keys” → Enable purge protection. Trap: Soft delete alone still allows purge.
“Contributors must not be able to grant themselves secret access” → Use the Azure RBAC permission model. Trap: Access policies allow this escalation.
“Single-tenant, FIPS 140 Level 3 HSM with customer-controlled security domain” → Managed HSM.
“HSM-protected keys at the lowest cost” → Key Vault Premium.
“Customer-managed keys for Storage/SQL encryption” → Key Vault or Managed HSM with soft delete + purge protection; access via managed identity.
“Rotate certificates automatically” → Key Vault certificate auto-renewal with integrated CA / key rotation policy.
“Separate vault per app per environment” → Recommended: limits blast radius and access scope.
“Get notified when secrets are near expiry” → Key Vault events via Event Grid (SecretNearExpiry).
“Azure Dedicated HSM” → Retiring: full support until Jul 31, 2028, no new onboardings; move to Azure Cloud HSM or Managed HSM. Trap: Existing Thales Luna key material can't be migrated, so create new keys.
“Azure Cloud HSM” → Single-tenant, FIPS 140-3 Level 3, customer-owned cluster of three HSM nodes, supports PKCS#11. Trap: Managed HSM is FIPS 140-2 Level 3; multitenant Key Vault is Level 2.