Azure Key Vault vs Keeper Secrets Manager

Azure Key Vault

Access runs on Microsoft Entra ID tokens and Azure roles that can be scoped to one secret, with soft delete, a 99.99 per cent SLA and a public OpenAPI contract. Secret rotation needs an Event Grid trigger and a function the owner writes, audit logging is off until enabled, and an Azure subscription needs a person and a payment card.

Keeper Secrets Manager

Each client device signs requests with its own key, is locked to an IP address by default and can be revoked alone, and secrets decrypt only on the client. The add-on has no public price, no request limits were found in the reviewed documentation, and a person must create the application and device in the vault.

Azure Key Vault

1. Request a token for the resource https://vault.azure.net and send it as a Bearer header. Every call must carry api-version, such as 2025-07-01, because there is no default
2. Ask for the Key Vault Secrets User role on the vault or the single secret. Key Vault Reader returns metadata only, not values
3. Cache secret values in memory. A vault allows 4,000 reads and 300 secret creations per 10 seconds, and a subscription five times that
4. On 429 wait 1, 2, 4, 8 then 16 seconds. Throttled requests do not count against the limit
5. Don't retry Set Secret blindly. Each successful call creates a new version of the secret

Keeper Secrets Manager

1. Ask the vault owner for a new device on an application that holds only the folders the task needs. Use the Base64 configuration, not the first one-time token
2. Run commands under ksm exec so secrets arrive as environment variables and stay out of the model's context
3. Expect HTTP 403 with {"error":"throttled"} under load. The Python SDK retries five times from 11 seconds, so allow for long waits
4. A device is locked to the IP address it first connects from unless it was created with --unlock-ip. Check this before running from a dynamic address
5. Leave --auto-approve off on the MCP server. It removes confirmation for deletes and for unmasking values