/azure-key-vault

name: azure-key-vault
description: Expert knowledge for Azure Key Vault development including troubleshooting, best practices, decision making, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when using Key Vault/Managed HSM with Private Link, Entra ID RBAC, BYOK/HSM keys, Event Grid, or Terraform, and other Azure Key Vault related development tasks. Not for Azure Cloud Hsm (use azure-cloud-hsm), Azure Dedicated HSM (use azure-dedicated-hsm), Azure Attestation (use azure-attestation), Azure Information Protection (use azure-information-protection).
compatibility: Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata:
  generated_at: "2026-11-08"
  generator: "docs2skills/1.0.0"

Azure Key Vault Skill

This skill provides expert guidance for Azure Key Vault. Covers troubleshooting, best practices, decision making, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file

> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)

This skill requires **network access** to fetch documentation content:

• **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.
• **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.

Category Index

| Category | Lines | Description | |----------|-------|-------------| | Troubleshooting | L36-L45 | Diagnosing and fixing Key Vault errors: REST/API codes, Private Link misconfig, access policy/Policy enforcement issues, and Managed HSM external key management failures. | | Best Practices | L46-L52 | Best practices for securing Key Vault keys, handling Managed HSM disaster recovery, and generating/importing BYOK HSM keys for compliant, resilient key management. | | Decision Making | L53-L63 | Guidance on choosing access control and API versions, planning and executing migrations (access policies→RBAC, external→Managed HSM keys), and sizing/scaling Managed HSM capacity. | | Limits & Quotas | L64-L75 | Limits, quotas, and behaviors for Key Vault and Managed HSM (certificates, secrets, throttling, logging latency, IP firewall/network rules, soft-delete/recovery, and capacity constraints). | | Security | L76-L106 | Securing Azure Key Vault and Managed HSM: auth (Entra ID, RBAC/ABAC, access policies), networking/firewalls/private endpoints, Zero Trust, BYOK/HSM key transfer, backup/restore, and best practices. | | Configuration | L107-L130 | Configuring Key Vault and Managed HSM for monitoring, logging, alerts, policies, key/secret types and rotation, secure key release, BYOK imports, and soft-delete/purge protection. | | Integrations & Coding Patterns | L131-L159 | Patterns and code samples for integrating Key Vault with apps and services (Event Grid, Logic Apps, Databricks, Private Link) and using keys/secrets from .NET, Node.js, Python, and JavaScript. | | Deployment | L160-L163 | How to deploy and provision Azure Key Vault and Managed HSM (vaults, keys, secrets) using ARM templates, Bicep, Terraform, Azure CLI, and PowerShell |

Troubleshooting

| Topic | URL | |-------|-----| | Resolve common Azure Key Vault error codes | https://learn.microsoft.com/en-us/azure/key-vault/general/common-error-codes | | Diagnose and fix Azure Key Vault Private Link configuration issues | https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-diagnostics | | Interpret Azure Key Vault REST API error codes | https://learn.microsoft.com/en-us/azure/key-vault/general/rest-error-codes | | Troubleshoot Azure Policy enforcement on Key Vault | https://learn.microsoft.com/en-us/azure/key-vault/general/troubleshoot-azure-policy-for-key-vault | | Troubleshoot Azure Key Vault access policy failures | https://learn.microsoft.com/en-us/azure/key-vault/general/troubleshooting-access-issues | | Troubleshoot Managed HSM external key management failures | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-troubleshooting |

Best Practices

| Topic | URL | |-------|-----| | Apply security best practices for Azure Key Vault keys | https://learn.microsoft.com/en-us/azure/key-vault/keys/secure-keys | | Execute disaster recovery for Azure Managed HSM disruptions | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/disaster-recovery-guide | | Generate and import BYOK HSM keys into Azure Managed HSM | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/hsm-protected-keys-byok |

Decision Making

| Topic | URL | |-------|-----| | Choose default access control model for Key Vault | https://learn.microsoft.com/en-us/azure/key-vault/general/access-control-default | | Decide and migrate to supported Key Vault API versions | https://learn.microsoft.com/en-us/azure/key-vault/general/migrate-api-version | | Plan and execute migration of cryptographic key workloads | https://learn.microsoft.com/en-us/azure/key-vault/general/migrate-key-workloads | | Migrate Azure Key Vault from access policies to RBAC | https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-migration | | Plan migration from external keys to Managed HSM keys | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-manage