Get an audit

Head to head · Secrets store · October 2026 research run

Azure Key Vault vs Pulumi ESC

Azure Key Vault scores 74.7 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 4 of 7 scored categories. Pulumi ESC leads on payments & pricing. Both do secrets store.

Azure Key VaultMicrosoft Corporation · HTTP API BB74.7/100#59 of 629 Pulumi ESCPulumi Corporation · HTTP API BB71.1/100#114 of 629

Which one, for what

Azure Key Vault BB

Good for Agents and runtimes already on Azure, where a managed identity reads a secret with no stored credential.

Ahead on

  • Reliability, 87 against 60
  • Security & auth, 86 against 79
  • Transparency & trust, 77 against 65

Watch for

No managed rotation for secrets. Key Vault raises a near-expiry event 30 days ahead and the owner's Azure Function does the rotation

Pulumi ESC BB

Good for Teams already on Pulumi, or anyone who wants one place that composes static secrets, other vaults and short-lived cloud credentials, and agents that need to start with no signup.

Ahead on

  • Payments & pricing, 55 against 20

Also in its favour

  • Free to start without a card

Watch for

Audit logs, custom roles, team tokens, approvals and customer-managed keys need Pro ($400 a month) or Enterprise

Score by category

CategoryWeight this runAzure Key VaultPulumi ESCEdge
Reliability16%208760Azure Key Vault +27
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.28582Azure Key Vault +3
Agent ergonomics13%16.27575even
Security & auth14%17.58679Azure Key Vault +7
Payments & pricing10%12.52055Pulumi ESC +35
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.88082Pulumi ESC +2
Transparency & trust7%8.87765Azure Key Vault +12
Negative events≤1500
Total74.7 · BB71.1 · BB

Facts side by side

FactAzure Key VaultPulumi ESC
KindHTTP APIHTTP API
VendorMicrosoft CorporationPulumi Corporation
Hosted endpointhttps://<vault-name>.vault.azure.nethttps://api.pulumi.com
TransportsHTTPHTTP
AuthOAuthOAuth or key
PricingPay per useFreemium
x402nono
LicenceProprietary service under Microsoft's Product Terms. The Azure SDK client libraries are MITProprietary service under Pulumi's Terms & Conditions. The Pulumi CLI, the ESC evaluator and the ESC SDKs are Apache-2.0
Read-only variant documentednoyes
llms.txtnoyes
Last release2026-10-022026-10-07
Terms last updatedno date givenno date given
Privacy policy last updated2026-09-01no date given
Customer content may train modelsyesnot found in the text
Terms restrict automated accessyesnot found in the text
Terms restrict benchmarkingyesnot found in the text
Terms or service can change without noticenot found in the textyes
Arbitration or class-action waivernot found in the textnot found in the text
Popularity2.6M npm/wk, 9.5M PyPI/wk21k npm/wk, 54k PyPI/wk

Verdicts

Azure Key Vault

Access runs on Microsoft Entra ID tokens and Azure roles that can be scoped to one secret, with soft delete, a 99.99 per cent SLA and a public OpenAPI contract. Secret rotation needs an Event Grid trigger and a function the owner writes, audit logging is off until enabled, and an Azure subscription needs a person and a payment card.

Pulumi ESC

An agent can start without a signup, because the Pulumi CLI creates a free ephemeral account that includes ESC, and the REST API has a public OpenAPI document. Audit logs, custom roles and approvals need the Pro edition at $400 a month, and no API rate limit was found in the reviewed documentation.

Before you call either

Azure Key Vault

  1. Request a token for the resource https://vault.azure.net and send it as a Bearer header. Every call must carry api-version, such as 2025-07-01, because there is no default
  2. Ask for the Key Vault Secrets User role on the vault or the single secret. Key Vault Reader returns metadata only, not values
  3. Cache secret values in memory. A vault allows 4,000 reads and 300 secret creations per 10 seconds, and a subscription five times that
  4. On 429 wait 1, 2, 4, 8 then 16 seconds. Throttled requests do not count against the limit
  5. Don't retry Set Secret blindly. Each successful call creates a new version of the secret

Pulumi ESC

  1. Use pulumi env, not esc. The standalone CLI stopped at v0.26.0 and gets no security fixes
  2. Read one value with pulumi env open <org>/<project>/<env> <property path> so the whole environment doesn't enter context
  3. Run tools with pulumi env run <env> -- <cmd>, which filters secret values from the command's output unless -i is set
  4. Set PULUMI_ACCESS_TOKEN for the SDKs. From 0.14.0 they no longer read the CLI login on disk
  5. Send Authorization: token <token> and Accept: application/vnd.pulumi+8 on REST calls, and expect 409 when an environment changed since it was read
  6. Relay the claim link an agent account prints. The account goes read-only after 72 hours and locks after 30 days unclaimed

Questions

Which is better for AI agents, Azure Key Vault or Pulumi ESC?

Azure Key Vault scores 74.7 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 4 of 7 scored categories. Pulumi ESC leads on payments & pricing.

Do Azure Key Vault and Pulumi ESC need an API key?

Azure Key Vault uses an OAuth sign-in. Pulumi ESC takes an API key or an OAuth sign-in.

Can an agent call Azure Key Vault and Pulumi ESC without installing anything?

Yes. Azure Key Vault has a hosted endpoint at https://<vault-name>.vault.azure.net and Pulumi ESC at https://api.pulumi.com.

Other comparisons with Azure Key Vault or Pulumi ESC

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report