{ "data": { "similar": [ { "grade": "A", "json": "https://www.anchorterminal.com/tools/infisical.json", "name": "Infisical", "score": 83.7, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "slug": "infisical" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/aws-secrets-manager.json", "name": "AWS Secrets Manager", "score": 77.7, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "slug": "aws-secrets-manager" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/google-secret-manager.json", "name": "Google Cloud Secret Manager", "score": 76.5, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "slug": "google-secret-manager" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/akeyless.json", "name": "Akeyless (SecretlessAI and MCP server)", "score": 73.6, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "slug": "akeyless" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/doppler.json", "name": "Doppler", "score": 71.4, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "slug": "doppler" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/pulumi-esc.json", "name": "Pulumi ESC", "score": 71.1, "shared": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "slug": "pulumi-esc" } ], "tool": { "slug": "azure-key-vault", "name": "Azure Key Vault", "vendor": "Microsoft Corporation", "vendorUrl": "https://azure.microsoft.com/en-us/products/key-vault", "kind": "http-api", "category": "secrets", "summary": "Microsoft Azure's managed store for secrets, encryption keys and TLS certificates. Applications read secrets over a REST API or the Azure SDKs and CLI, signing in with Microsoft Entra ID and authorised by Azure role assignments.", "url": "https://www.anchorterminal.com/tools/azure-key-vault", "markdownUrl": "https://www.anchorterminal.com/tools/azure-key-vault.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/azure-key-vault.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/azure-key-vault.json", "repo": "https://github.com/Azure/azure-rest-api-specs", "license": "Proprietary service under Microsoft's Product Terms. The Azure SDK client libraries are MIT", "transports": [ "http" ], "remoteUrl": "https://\u003cvault-name\u003e.vault.azure.net", "packages": [ { "registry": "pypi", "name": "azure-keyvault-secrets" }, { "registry": "npm", "name": "@azure/keyvault-secrets" }, { "registry": "go", "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets" } ], "auth": "oauth", "authNotes": "Every data plane call carries a Microsoft Entra ID OAuth 2.0 bearer token for the scope https://vault.azure.net/.default. There are no API keys. A workload on Azure uses a managed identity, and anything else uses a service principal registered in the vault's Entra tenant. Access is self-serve inside an Azure subscription. An owner assigns a role such as Key Vault Secrets User (read secret contents) or Key Vault Secrets Officer at subscription, resource group, vault or single-secret scope. Legacy vault access policies still work, and Microsoft's guidance says not to use them for critical data (https://learn.microsoft.com/en-us/azure/key-vault/general/authentication, https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide).", "pricing": "usage", "pricingNotes": "$0.03 per 10,000 operations on secrets in both the Standard and Premium tiers in East US, with no charge per stored secret. Renewal of a managed storage account key is metered at $1, and a certificate renewal request at $3. The pricing page draws its numbers by script, so these come from the Azure Retail Prices API (https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20%27Key%20Vault%27%20and%20armRegionName%20eq%20%27eastus%27). No free allowance for Key Vault was found on the free services page. A new Azure account gets $200 of credit for 30 days and needs a phone number and a credit or debit card (https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account).", "priceSummary": "$0.003 / 1k calls", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Key Vault docs, the REST reference or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 2598246, "pypiWeekly": 9507749, "asOf": "2026-10-08" }, "docsUrl": "https://learn.microsoft.com/en-us/azure/key-vault/", "openapi": "https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/keyvault/data-plane/Secrets/stable/2025-07-01/secrets.json", "capabilities": [ "secrets.store", "secrets.machine-identity", "secrets.audit", "secrets.rotate", "infra.azure" ], "tags": [ "hosted", "closed-source", "usage-priced", "card-required", "openapi", "oauth", "python", "typescript", "go", "dotnet", "java", "enterprise", "sla", "eu" ], "lastRelease": "2026-10-02", "graded": true, "anchor": { "graded": true, "score": 74.7, "grade": "BB", "agentReady": true, "rank": 60, "ranked": true, "rankOf": 722, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 80, "payments": 20, "reliability": 87, "schema": 85, "security": 86, "transparency": 77 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 87, "points": 17.4, "reason": "Hosted reading. Azure status page with a history of post-incident reviews (20). The history lists three incidents in the last 90 days, West US network connectivity on 23 July 2026 (14:44 to 19:41 UTC), Azure OpenAI and Cognitive Services in Sweden Central on 29 September, and gateway services in several regions on 30 September. None names Key Vault. The page lists only broad incidents and the West US fault blocked traffic entering or leaving that region, so we count the record as minor (20 of 30). Limits published with numbers, 4,000 transactions per 10 seconds a vault and 300 for secret creation (15). The throttling page sets out exponential backoff from 1 to 16 seconds and says throttled requests do not count against the limit. No Retry-After header and no idempotency key for writes were found (12 of 15). The SLA document of 1 October 2026 commits to 99.99 per cent with 10 and 25 per cent credits (10). Generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 85, "points": 13.81, "reason": "A public OpenAPI 2.0 document for the secrets data plane, version 2025-07-01, with 12 operations (25). learn.microsoft.com/llms.txt returns 404, but every Learn page we asked for with `Accept: text/markdown` came back as Markdown, so half (5 of 10). Each operation states its purpose and the permission it needs, and the throttling page says when not to use Key Vault, such as for customers' secrets at high throughput (16 of 20). A pattern on secret names, a 1 to 25 range on `maxresults` and an enum for the recovery level. The value is a free string and tags a free object (13 of 15). Sample requests and responses on each reference page. Errors appear only as a generic KeyVaultError, with a separate page for 401, 403 and 429 (11 of 15). Dated `api-version` values and a what's new page, whose newest entry is March 2026 (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 75, "points": 12.19, "reason": "API reading. Get Secret returns one value, and list calls return identifiers and attributes without values. There is no field selection (20 of 25). `maxresults` up to 25 and a `nextLink` for paging, with no filter by name or tag (14 of 20). Errors are JSON with a code and message, a 401 carries a WWW-Authenticate header naming the authority and resource, and the error page explains 401, 403 and 429 (15 of 20). Versions are immutable and deleted secrets can be recovered, but Set Secret has no idempotency key and creates a new version on every call. Key Vault has no MCP server of its own to annotate. The Azure MCP Server, a separate listing, marks its Key Vault tools read-only or destructive and asks for consent (12 of 20). SDKs for Python, JavaScript, .NET, Java and Go, and a read needs only the vault and secret name. `api-version` is required on every REST call (14 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 86, "points": 15.05, "reason": "Microsoft Entra ID OAuth 2.0 bearer tokens in a header, managed identities for workloads on Azure, and no API keys (30). Key Vault Secrets User reads secret contents only, Key Vault Reader sees metadata only, roles can be assigned on one secret, purging needs its own role, and deleted secrets stay recoverable for 7 to 90 days. Nothing asks for approval on a write (18 of 20). The service returns no untrusted content (10). AuditEvent logs record each operation with caller identity and IP address, but only after the owner adds a diagnostic setting (12 of 15). MSRC coordinated disclosure and bounty policies and a SOC 2 Type 2 report covering Azure. The microsoft.com security.txt passed its Expires date on 23 September 2026, and we could not confirm Key Vault on the audit scope list (16 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "No x402, MPP or L402 (0). $0.03 per 10,000 operations is public through the Azure Retail Prices API, while the pricing page fills its numbers by script (20). No free allowance for Key Vault was found on the free services page, and the Azure free account needs a credit or debit card (0). A person signs up in a browser with a phone number and a card (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 80, "points": 7, "reason": "Read as a closed service with official SDKs. azure-keyvault-secrets 4.11.3 reached PyPI on 2 October 2026 (30). Three Python releases in the last 90 days, 4.11.1 on 12 August, 4.11.2 on 25 August and 4.11.3 on 2 October (20). A public what's new page whose newest entry is March 2026, Microsoft Q\u0026A and the SDK issue trackers on GitHub, which we did not read (10 of 15). Official SDKs current in Python, JavaScript, .NET, Go and Java (15). The SDKs are released from the azure-sdk monorepos, CI not checked (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 77, "points": 6.74, "note": "editorial 67, provenance 86", "reason": "Closed service under Microsoft's Product Terms, with MIT client libraries (15 of 30). The privacy statement, last updated September 2026, sends Azure customer data to the Product Terms and the Data Protection Addendum. The Key Vault docs say Microsoft doesn't see or extract your data and that logs stay in storage the customer owns. We did not read the addendum itself (22 of 30). Microsoft's Modern Lifecycle Policy promises 12 months' notice before support ends, and Key Vault gives a dated retirement, 27 February 2027, for control plane API versions before 2026-02-01 (18 of 20). Replication stays within the region and its paired region in the same geography. The sub-processor list sits on the Service Trust Portal, a script-drawn page we could not read (12 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "API reading. Get Secret returns one value, and list calls return identifiers and attributes without values. There is no field selection (20 of 25). `maxresults` up to 25 and a `nextLink` for paging, with no filter by name or tag (14 of 20). Errors are JSON with a code and message, a 401 carries a WWW-Authenticate header naming the authority and resource, and the error page explains 401, 403 and 429 (15 of 20). Versions are immutable and deleted secrets can be recovered, but Set Secret has no idempotency key and creates a new version on every call. Key Vault has no MCP server of its own to annotate. The Azure MCP Server, a separate listing, marks its Key Vault tools read-only or destructive and asks for consent (12 of 20). SDKs for Python, JavaScript, .NET, Java and Go, and a read needs only the vault and secret name. `api-version` is required on every REST call (14 of 15).", "maintenance": "Read as a closed service with official SDKs. azure-keyvault-secrets 4.11.3 reached PyPI on 2 October 2026 (30). Three Python releases in the last 90 days, 4.11.1 on 12 August, 4.11.2 on 25 August and 4.11.3 on 2 October (20). A public what's new page whose newest entry is March 2026, Microsoft Q\u0026A and the SDK issue trackers on GitHub, which we did not read (10 of 15). Official SDKs current in Python, JavaScript, .NET, Go and Java (15). The SDKs are released from the azure-sdk monorepos, CI not checked (5 of 10).", "payments": "No x402, MPP or L402 (0). $0.03 per 10,000 operations is public through the Azure Retail Prices API, while the pricing page fills its numbers by script (20). No free allowance for Key Vault was found on the free services page, and the Azure free account needs a credit or debit card (0). A person signs up in a browser with a phone number and a card (0).", "reliability": "Hosted reading. Azure status page with a history of post-incident reviews (20). The history lists three incidents in the last 90 days, West US network connectivity on 23 July 2026 (14:44 to 19:41 UTC), Azure OpenAI and Cognitive Services in Sweden Central on 29 September, and gateway services in several regions on 30 September. None names Key Vault. The page lists only broad incidents and the West US fault blocked traffic entering or leaving that region, so we count the record as minor (20 of 30). Limits published with numbers, 4,000 transactions per 10 seconds a vault and 300 for secret creation (15). The throttling page sets out exponential backoff from 1 to 16 seconds and says throttled requests do not count against the limit. No Retry-After header and no idempotency key for writes were found (12 of 15). The SLA document of 1 October 2026 commits to 99.99 per cent with 10 and 25 per cent credits (10). Generally available (10).", "schema": "A public OpenAPI 2.0 document for the secrets data plane, version 2025-07-01, with 12 operations (25). learn.microsoft.com/llms.txt returns 404, but every Learn page we asked for with `Accept: text/markdown` came back as Markdown, so half (5 of 10). Each operation states its purpose and the permission it needs, and the throttling page says when not to use Key Vault, such as for customers' secrets at high throughput (16 of 20). A pattern on secret names, a 1 to 25 range on `maxresults` and an enum for the recovery level. The value is a free string and tags a free object (13 of 15). Sample requests and responses on each reference page. Errors appear only as a generic KeyVaultError, with a separate page for 401, 403 and 429 (11 of 15). Dated `api-version` values and a what's new page, whose newest entry is March 2026 (15).", "security": "Microsoft Entra ID OAuth 2.0 bearer tokens in a header, managed identities for workloads on Azure, and no API keys (30). Key Vault Secrets User reads secret contents only, Key Vault Reader sees metadata only, roles can be assigned on one secret, purging needs its own role, and deleted secrets stay recoverable for 7 to 90 days. Nothing asks for approval on a write (18 of 20). The service returns no untrusted content (10). AuditEvent logs record each operation with caller identity and IP address, but only after the owner adds a diagnostic setting (12 of 15). MSRC coordinated disclosure and bounty policies and a SOC 2 Type 2 report covering Azure. The microsoft.com security.txt passed its Expires date on 23 September 2026, and we could not confirm Key Vault on the audit scope list (16 of 20).", "transparency": "Closed service under Microsoft's Product Terms, with MIT client libraries (15 of 30). The privacy statement, last updated September 2026, sends Azure customer data to the Product Terms and the Data Protection Addendum. The Key Vault docs say Microsoft doesn't see or extract your data and that logs stay in storage the customer owns. We did not read the addendum itself (22 of 30). Microsoft's Modern Lifecycle Policy promises 12 months' notice before support ends, and Key Vault gives a dated retirement, 27 February 2027, for control plane API versions before 2026-02-01 (18 of 20). Replication stays within the region and its paired region in the same geography. The sub-processor list sits on the Service Trust Portal, a script-drawn page we could not read (12 of 20)." }, "sources": [ { "what": "what's new", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/whats-new", "seen": "2026-10-08" }, { "what": "service limits", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/service-limits", "seen": "2026-10-08" }, { "what": "throttling guidance", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/overview-throttling", "seen": "2026-10-08" }, { "what": "authentication", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/authentication", "seen": "2026-10-08" }, { "what": "Azure RBAC guide", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide", "seen": "2026-10-08" }, { "what": "logging", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/logging", "seen": "2026-10-08" }, { "what": "soft delete", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview", "seen": "2026-10-08" }, { "what": "about secrets", "url": "https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets", "seen": "2026-10-08" }, { "what": "autorotation", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/autorotation", "seen": "2026-10-08" }, { "what": "reliability and failover", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance", "seen": "2026-10-08" }, { "what": "API version retirement", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/migrate-api-version", "seen": "2026-10-08" }, { "what": "REST error codes", "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/rest-error-codes", "seen": "2026-10-08" }, { "what": "REST reference, Get Secret", "url": "https://learn.microsoft.com/en-us/rest/api/keyvault/secrets/get-secret/get-secret", "seen": "2026-10-08" }, { "what": "REST reference, Set Secret", "url": "https://learn.microsoft.com/en-us/rest/api/keyvault/secrets/set-secret/set-secret", "seen": "2026-10-08" }, { "what": "OpenAPI document, secrets 2025-07-01", "url": "https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/keyvault/data-plane/Secrets/stable/2025-07-01/secrets.json", "seen": "2026-10-08" }, { "what": "retail prices, East US", "url": "https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20%27Key%20Vault%27%20and%20armRegionName%20eq%20%27eastus%27", "seen": "2026-10-08" }, { "what": "pricing page", "url": "https://azure.microsoft.com/en-us/pricing/details/key-vault/", "seen": "2026-10-08" }, { "what": "Azure free account", "url": "https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account", "seen": "2026-10-08" }, { "what": "free services", "url": "https://azure.microsoft.com/en-us/pricing/free-services", "seen": "2026-10-08" }, { "what": "SLA for Online Services, 1 October 2026", "url": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services", "seen": "2026-10-08" }, { "what": "status history", "url": "https://azure.status.microsoft/en-us/status/history/", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.microsoft.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "Product Terms for Online Services", "url": "https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all", "seen": "2026-10-08" }, { "what": "Online Subscription Agreement", "url": "https://azure.microsoft.com/en-us/support/legal/subscription-agreement/", "seen": "2026-10-08" }, { "what": "privacy statement", "url": "https://www.microsoft.com/en-us/privacy/privacystatement", "seen": "2026-10-08" }, { "what": "Modern Lifecycle Policy", "url": "https://learn.microsoft.com/en-us/lifecycle/policies/modern", "seen": "2026-10-08" }, { "what": "SOC 2 offering", "url": "https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-soc-2", "seen": "2026-10-08" }, { "what": "Python SDK on PyPI", "url": "https://pypi.org/project/azure-keyvault-secrets/", "seen": "2026-10-08" }, { "what": "Python SDK changelog", "url": "https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md", "seen": "2026-10-08" }, { "what": "JavaScript SDK on npm", "url": "https://registry.npmjs.org/@azure/keyvault-secrets", "seen": "2026-10-08" }, { "what": "Azure MCP Server commands", "url": "https://github.com/microsoft/mcp/blob/main/servers/Azure.Mcp.Server/docs/azmcp-commands.md", "seen": "2026-10-08" } ], "openQuestions": [ "The lead was right on the interface and the docs. Its URL redirects to https://azure.microsoft.com/en-us/products/key-vault.", "unchecked: whether Key Vault is on Azure's SOC 2 audit scope list. The scope page we loaded did not name services, and the reports sit on the Service Trust Portal.", "unchecked: the Microsoft sub-processor list and the Data Protection Addendum. The Service Trust Portal page is drawn by script and the addendum page did not load.", "unchecked: the Azure bounty programme page, which answered 403. The bounty policy link comes from security.txt.", "unchecked: incidents limited to one region or one service, since the public status history lists only broad incidents.", "unchecked: CI and open issues for the azure-sdk repositories.", "The Python changelog on GitHub still marks 4.11.3 as unreleased, while PyPI shows it uploaded on 2 October 2026. lastRelease follows PyPI.", "Not established: whether 429 responses carry a Retry-After header, and whether throttled calls are billed.", "The Product Terms page showed no effective date when read." ] }, "negative": 0, "verdict": "Access runs on Microsoft Entra ID tokens and Azure roles that can be scoped to one secret, with soft delete, a 99.99 per cent SLA and a public OpenAPI contract. Secret rotation needs an Event Grid trigger and a function the owner writes, audit logging is off until enabled, and an Azure subscription needs a person and a payment card.", "bestFor": "Agents and runtimes already on Azure, where a managed identity reads a secret with no stored credential.", "strengths": [ "No API keys. Every call carries a Microsoft Entra ID bearer token, and managed identities remove stored credentials for workloads on Azure", "Azure roles can be assigned on a vault or one secret, with Key Vault Secrets User limited to reading secret contents", "Deleted secrets stay recoverable for 7 to 90 days, and purging needs a separate permission", "SLA of 99.99 per cent uptime for read transactions, with 10 and 25 per cent credits, in the 1 October 2026 SLA document", "Public OpenAPI 2.0 contract for the 12 secrets operations, and Learn pages returned as Markdown on request" ], "weaknesses": [ "No managed rotation for secrets. Key Vault raises a near-expiry event 30 days ahead and the owner's Azure Function does the rotation", "Audit logging is off until a diagnostic setting sends AuditEvent logs to a storage account, event hub or Azure Monitor", "Set Secret has no idempotency key, so a retried write adds another version", "Listing returns at most 25 secrets a page with no name or tag filter", "No free allowance for Key Vault was found, and an Azure account needs a phone number and a credit or debit card" ], "agentNotes": [ "Request a token for the resource https://vault.azure.net and send it as a Bearer header. Every call must carry `api-version`, such as 2025-07-01, because there is no default", "Ask for the Key Vault Secrets User role on the vault or the single secret. Key Vault Reader returns metadata only, not values", "Cache secret values in memory. A vault allows 4,000 reads and 300 secret creations per 10 seconds, and a subscription five times that", "On 429 wait 1, 2, 4, 8 then 16 seconds. Throttled requests do not count against the limit", "Don't retry Set Secret blindly. Each successful call creates a new version of the secret" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.7 } ], "editorialScores": { "ergonomics": 75, "maintenance": 80, "payments": 20, "reliability": 87, "schema": 85, "security": 86, "transparency": 67 }, "provenanceScore": 86 }, "connect": { "install": "pip install azure-keyvault-secrets azure-identity # or: npm i @azure/keyvault-secrets @azure/identity", "http": "GET https://\u003cvault-name\u003e.vault.azure.net/secrets/\u003csecret-name\u003e?api-version=2025-07-01\nAuthorization: Bearer \u003cEntra ID access token for https://vault.azure.net\u003e" }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/azure-key-vault" }, "sameCompany": [ "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "microsoft-entra-agent-id", "azure-devops-mcp", "microsoft-learn-mcp", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "microsoft-graph-calendar", "microsoft-teams", "dynamics-365-sales", "power-automate", "microsoft-advertising-api", "microsoft-excel-graph", "outlook-mail-graph" ], "notable": [ "The secrets data plane has 12 operations at https://\u003cvault-name\u003e.vault.azure.net, newest stable API version 2025-07-01, with a preview 2026-07-01-preview in the specs repository (https://github.com/Azure/azure-rest-api-specs/tree/main/specification/keyvault/data-plane/Secrets)", "A vault allows 4,000 transactions per 10 seconds, 300 for secret creation and key or certificate import combined, and a subscription five times the vault limit (https://learn.microsoft.com/en-us/azure/key-vault/general/service-limits)", "Azure RBAC is the default access model for vaults created with control plane API 2026-02-01, and control plane versions before it retire on 27 February 2027 (https://learn.microsoft.com/en-us/azure/key-vault/general/whats-new)", "Attribute-based conditions on role assignments, such as secrets whose names match a pattern, are in preview and apply only to secret data actions (https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide)", "Vault contents replicate within the region and, where the paired region is in the same geography, to that region. After a Microsoft-managed failover the vault is read-only (https://learn.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance)", "Microsoft's Azure MCP Server, listed separately, has `keyvault secret get` and `keyvault secret create` tools that ask the user for consent before returning or writing a secret value (https://github.com/microsoft/mcp/blob/main/servers/Azure.Mcp.Server/docs/azmcp-commands.md)", "azure-keyvault-secrets 4.11.1 and 4.11.2 (12 and 25 August 2026) fixed bugs in the SDK's authentication challenge handling, one of which let a request's method, URL and body reach a later request on the same client (https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md)" ], "area": "agent-runtime", "details": [ { "label": "API", "value": "REST data plane at https://\u003cvault-name\u003e.vault.azure.net, 12 secrets operations (get, set, update, delete, list, versions, backup, restore, and four for deleted secrets). Stable API version 2025-07-01. Vaults are created through Azure Resource Manager, control plane version 2026-02-01" }, { "label": "Credentials", "value": "Microsoft Entra ID bearer tokens only. Managed identities on Azure, service principals elsewhere. Roles assignable down to one secret" }, { "label": "Rate limits", "value": "Per vault per region, 4,000 transactions per 10 seconds, 300 for secret creation and key or certificate import combined. A subscription gets five times the vault limit" }, { "label": "Limits", "value": "25 KB a secret, 25 results a list page, no cap on secrets or versions in a vault. Backup fails above 500 versions" }, { "label": "Deletion", "value": "Soft delete keeps deleted vaults and secrets recoverable for 7 to 90 days (90 by default). Purge protection blocks early purging" }, { "label": "Rotation", "value": "Keys rotate by policy. Secrets rotate through an Event Grid near-expiry event, raised 30 days before expiry, and an Azure Function the owner supplies" }, { "label": "Audit", "value": "AuditEvent logs through a diagnostic setting to a storage account, event hub or Azure Monitor, with caller identity and IP address, readable within 10 minutes. Not on by default" }, { "label": "SLA", "value": "99.99% monthly uptime for transactions other than creating, updating or deleting vaults, keys or secrets. Credits of 10% below 99.99% and 25% below 99%" }, { "label": "Tiers", "value": "Standard (software cryptography validated to FIPS 140 Level 1) and Premium (keys in HSMs validated to FIPS 140-3 Level 3). Secrets cost the same in both" }, { "label": "SDKs", "value": "Python azure-keyvault-secrets 4.11.3 (2 October 2026), JavaScript @azure/keyvault-secrets 4.11.2, .NET Azure.Security.KeyVault.Secrets 4.11.2, Go azsecrets v1.5.0, and Java. MIT" }, { "label": "MCP server", "value": "None dedicated. The Azure MCP Server, listed separately, has Key Vault secret, key and certificate tools with consent prompts and a read-only mode" } ], "unitPrices": [ { "item": "Secrets operations", "unit": "1k-calls", "usd": 0.003, "note": "$0.03 per 10,000 operations, East US, Standard and Premium" }, { "item": "Certificate renewal request", "unit": "tx", "usd": 3, "note": "Per renewal request" } ], "provenance": { "legalEntity": "Microsoft Corporation", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "domainNote": "Vaults answer at \u003cvault-name\u003e.vault.azure.net and management calls at management.azure.com, both Microsoft domains. Docs are on learn.microsoft.com.", "endpointOnVendorDomain": true, "terms": "https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all", "privacy": "https://www.microsoft.com/en-us/privacy/privacystatement", "statusPage": "https://azure.status.microsoft/en-us/status", "changelog": "https://learn.microsoft.com/en-us/azure/key-vault/general/whats-new", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "The Product Terms for Online Services cover Microsoft Azure, point to the Data Protection Addendum for customer data and to aka.ms/CSLA for the SLA. The page showed no effective date when read on 8 October 2026.", "Self-serve Azure accounts also accept the Microsoft Online Subscription Agreement (last updated March 2019, Microsoft Corporation, Washington law) at https://azure.microsoft.com/en-us/support/legal/subscription-agreement/, which incorporates the Online Services Terms and the SLAs.", "The privacy statement (last updated September 2026) names Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, and Microsoft Ireland Operations Limited in Dublin. It lists Microsoft Azure among the enterprise online services and says the customer's agreement controls where the two conflict.", "https://www.microsoft.com/.well-known/security.txt shows Expires 2026-09-23T16:00:00.000Z. It points to the MSRC researcher portal, the bounty policy and the coordinated disclosure policy.", "RDAP for microsoft.com gives a registration date of 1991-05-02.", "The what's new page is dated 8 September 2026 and its newest entry is March 2026." ], "score": 86, "checks": [ { "check": "Legal entity named", "value": "Microsoft Corporation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "microsoft.com, registered 1991-05-02 (35 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "\u003cvault-name\u003e.vault.azure.net", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 4 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 3.4, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "azure.status.microsoft/en-us/status", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "published but past its Expires date", "points": 5, "max": 10, "state": "part" } ], "policies": [ { "kind": "terms", "url": "https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all", "state": "read", "readAt": "2026-10-08", "words": 5677, "points": 3.4, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": false }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…no responsibility or liability for any losses or damages due to performance issues (including but not limited to security vulnerabilities, data loss, or service interruptions) of a Product that customer uses after the end of the applicable support period as provided in the Product Support Lifecycle [https://learn.micr…" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If Microsoft suspends the Online Service, Microsoft will suspend only to the extent reasonably necessary." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Except as permitted in this paragraph or in the Online Service-specific Terms, Customer may not reassign an SL on a short-term basis (i.e., within 90 days of the last assignment)." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Many Online Services offer a Service Level Agreement (SLA)." } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Customer may not use web scraping, web harvesting, or other data extraction methods to extract data from a Microsoft Generative AI Service.", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "If Customer offers a product or service competitive to an Online Service, by using the Online Service, Customer waives any restrictions on competitive use and benchmark testing in the terms governing its competitive products and services.", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "A subscription that is not renewed can continue month by month, and Microsoft may invoice that period at the monthly price plus a three per cent uplift for certain Products.", "quote": "Microsoft reserves the right to invoice Customer for the Extended Term at the then-current published price for a monthly subscription plus a three (3) percent uplift for certain Products." }, { "date": "2026-10-08", "text": "After an account is disabled, the customer has 90 days to extract Customer Data and the subscription cannot be reactivated.", "quote": "Customer will have 90 days to extract Customer Data from a disabled account, but the Subscription cannot be reactivated." }, { "date": "2026-10-08", "text": "The customer is responsible for any application or AI agent it creates with Microsoft AI Services, including legal, regulatory and licensing compliance.", "quote": "Customer is responsible for the design, development and use of any application or AI agent it creates using or for use with Microsoft AI Services, including complying with any legal, regulatory, or licensing requirements applicable to the resulting application or AI agent or its use." } ] }, { "kind": "privacy", "url": "https://www.microsoft.com/en-us/privacy/privacystatement", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-01", "words": 33580, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: September 2026", "says": "Last updated 2026-09-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "The data we collect depends on the context of your interactions with Microsoft and the choices you make, including your privacy settings and the products and features you use." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "When you delete an email or item from a mailbox in Outlook.com, the item generally goes into your Deleted Items folder where it remains for approximately 7 days unless you move it back to your inbox, you empty the folder, or the service empties the folder automatically, whichever comes first.", "says": "Names a period of 7 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Service providers that help us determine your device’s location." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "not use or share student personal data for advertising or similar commercial purposes, such as providing personalized advertising to students;" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "State Data Privacy Notice (including notice at collection details) and the Consumer Health Data Privacy Policy for additional information about your rights and the processing of your personal data." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have a privacy concern, complaint, or question for the Microsoft privacy team or Data Protection Officer, please visit our privacy support and requests page and click on “Contact the Microsoft privacy team or the Microsoft Data Protection Officer” menu.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "In such cases, we implement legal safeguards-such as standard contractual clauses approved by the European Commission – to help protect your rights and ensure your data remains protected.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models.", "costsPoints": true }, { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We also disclose personal data for digital advertising purposes." } ], "notes": [ { "date": "2026-10-08", "text": "For enterprise and developer products, the customer's agreement with Microsoft takes precedence over this privacy statement where the two conflict.", "quote": "In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control." }, { "date": "2026-10-08", "text": "Prompts and related data sent to the consumer Microsoft Copilot are used to improve services and for relevant advertising.", "quote": "Microsoft Copilot also uses prompts and related data to provide and improve services, including relevant advertising." }, { "date": "2026-10-08", "text": "Microsoft staff manually review some results of its automated systems, including AI, against the source data.", "quote": "For example, to build, train, and improve the accuracy of our automated systems – such as AI - we manually review some of the results against the underlying data." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/azure-key-vault.json", "live": { "slug": "azure-key-vault", "probe": { "target": "https://\u003cvault-name\u003e.vault.azure.net", "method": "get", "lastAt": "2026-10-08T20:21:07.231631834Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "DNS lookup failed", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 32, "samples30d": 32, "days": [ { "date": "2026-10-08", "probes": 32, "ok": 0 } ], "outages": [ { "start": "2026-10-08T17:31:30.488017607Z", "end": "0001-01-01T00:00:00Z", "note": "DNS lookup failed" } ] }, "pages": [ { "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/whats-new", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:21:34.108322139Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8d3dc460aaab" }, { "url": "https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:15:36.079506243Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "7a404bea65bc" }, { "url": "https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20%27Key%20Vault%27%20and%20armRegionName%20eq%20%27eastus%27", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:23:22.816237311Z", "changedAt": "0001-01-01T00:00:00Z" } ], "updatedAt": "2026-10-08T20:21:07.231631834Z" } }, "verify": { "accepts": "a page on microsoft.com or one of its subdomains, or the README of github.com/Azure/azure-rest-api-specs", "badgeUrl": "https://www.anchorterminal.com/badges/azure-key-vault.svg", "body": { "slug": "azure-key-vault", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/azure-key-vault", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/azure-key-vault\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/azure-key-vault.svg\" alt=\"Azure Key Vault on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Azure Key Vault on Anchor Terminal](https://www.anchorterminal.com/badges/azure-key-vault.svg)](https://www.anchorterminal.com/tools/azure-key-vault)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/azure-key-vault\"\u003eAzure Key Vault on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/azure-key-vault", "json": "https://www.anchorterminal.com/tools/azure-key-vault.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/azure-key-vault.md", "slim": "https://www.anchorterminal.com/tools/azure-key-vault.min.md" }, "markdown": "## Overview\n\n**Grade BB · 74.7/100 · rank #60 of 722 · #4 in Secrets \u0026 credential vaults · agent-ready · confidence medium**\n\n\nMore from Microsoft Corporation, listed separately because each is its own product: [Microsoft Foundry fine-tuning (Azure OpenAI)](https://www.anchorterminal.com/tools/azure-foundry-fine-tuning.md) (Fine-tuning), [Azure AI Content Safety (Prompt Shields)](https://www.anchorterminal.com/tools/azure-ai-content-safety.md) (Guardrails \u0026 safety filters), [Azure AI Speech speech-to-text](https://www.anchorterminal.com/tools/azure-speech-to-text.md) (Speech-to-text), [Azure AI Speech text-to-speech](https://www.anchorterminal.com/tools/azure-text-to-speech.md) (Text-to-speech), [Microsoft Agent Framework](https://www.anchorterminal.com/tools/microsoft-agent-framework.md) (Agent frameworks \u0026 SDKs), [Microsoft Execution Containers](https://www.anchorterminal.com/tools/microsoft-execution-containers.md) (Code execution sandboxes), [Microsoft Entra Agent ID](https://www.anchorterminal.com/tools/microsoft-entra-agent-id.md) (Agent auth \u0026 delegated access), [Azure DevOps MCP Server](https://www.anchorterminal.com/tools/azure-devops-mcp.md) (Code \u0026 developer platforms), [Microsoft Learn MCP Server](https://www.anchorterminal.com/tools/microsoft-learn-mcp.md) (Code \u0026 developer platforms), [Playwright MCP](https://www.anchorterminal.com/tools/playwright-mcp.md) (Browser automation), [Azure MCP Server](https://www.anchorterminal.com/tools/azure-mcp.md) (Cloud \u0026 infrastructure), [Azure Maps](https://www.anchorterminal.com/tools/azure-maps.md) (Maps, geocoding \u0026 places), [Azure Translator](https://www.anchorterminal.com/tools/azure-translator.md) (Translation), [Microsoft Graph Calendar API](https://www.anchorterminal.com/tools/microsoft-graph-calendar.md) (Calendars \u0026 scheduling), [Microsoft Teams (Microsoft Graph)](https://www.anchorterminal.com/tools/microsoft-teams.md) (Work \u0026 productivity), [Microsoft Dynamics 365 Sales](https://www.anchorterminal.com/tools/dynamics-365-sales.md) (CRM \u0026 customer platforms), [Microsoft Power Automate](https://www.anchorterminal.com/tools/power-automate.md) (Workflow automation), [Microsoft Advertising API](https://www.anchorterminal.com/tools/microsoft-advertising-api.md) (Advertising \u0026 campaign operations), [Microsoft Excel (Microsoft Graph workbook API)](https://www.anchorterminal.com/tools/microsoft-excel-graph.md) (Spreadsheets \u0026 operational tables), [Outlook Mail (Microsoft Graph)](https://www.anchorterminal.com/tools/outlook-mail-graph.md) (Mailbox access).\n\n## Assessment\n\nAccess runs on Microsoft Entra ID tokens and Azure roles that can be scoped to one secret, with soft delete, a 99.99 per cent SLA and a public OpenAPI contract. Secret rotation needs an Event Grid trigger and a function the owner writes, audit logging is off until enabled, and an Azure subscription needs a person and a payment card.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Microsoft Corporation (https://azure.microsoft.com/en-us/products/key-vault) |\n| Kind | HTTP API |\n| Category | Secrets \u0026 credential vaults (https://www.anchorterminal.com/categories/secrets) |\n| Transport | HTTP |\n| Endpoint | `https://\u003cvault-name\u003e.vault.azure.net` |\n| Auth | OAuth · Every data plane call carries a Microsoft Entra ID OAuth 2.0 bearer token for the scope https://vault.azure.net/.default. There are no API keys. A workload on Azure uses a managed identity, and anything else uses a service principal registered in the vault's Entra tenant. Access is self-serve inside an Azure subscription. An owner assigns a role such as Key Vault Secrets User (read secret contents) or Key Vault Secrets Officer at subscription, resource group, vault or single-secret scope. Legacy vault access policies still work, and Microsoft's guidance says not to use them for critical data (https://learn.microsoft.com/en-us/azure/key-vault/general/authentication, https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide). |\n| Pricing | Pay per use ($0.003 / 1k calls) · $0.03 per 10,000 operations on secrets in both the Standard and Premium tiers in East US, with no charge per stored secret. Renewal of a managed storage account key is metered at $1, and a certificate renewal request at $3. The pricing page draws its numbers by script, so these come from the Azure Retail Prices API (https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20%27Key%20Vault%27%20and%20armRegionName%20eq%20%27eastus%27). No free allowance for Key Vault was found on the free services page. A new Azure account gets $200 of credit for 30 days and needs a phone number and a credit or debit card (https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account). |\n| x402 | No · No x402, MPP or L402 in the Key Vault docs, the REST reference or the pricing page (checked 2026-10-08). |\n| Licence | Proprietary service under Microsoft's Product Terms. The Azure SDK client libraries are MIT |\n| Packages | pypi: `azure-keyvault-secrets`; npm: `@azure/keyvault-secrets`; go: `github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets` |\n| Source | https://github.com/Azure/azure-rest-api-specs |\n| Docs | https://learn.microsoft.com/en-us/azure/key-vault/ |\n| llms.txt | not found |\n| Last release | 2026-10-02 |\n| npm downloads / week | 2,598,246 |\n| PyPI downloads / week | 9,507,749 |\n| API | REST data plane at https://\u003cvault-name\u003e.vault.azure.net, 12 secrets operations (get, set, update, delete, list, versions, backup, restore, and four for deleted secrets). Stable API version 2025-07-01. Vaults are created through Azure Resource Manager, control plane version 2026-02-01 |\n| Credentials | Microsoft Entra ID bearer tokens only. Managed identities on Azure, service principals elsewhere. Roles assignable down to one secret |\n| Rate limits | Per vault per region, 4,000 transactions per 10 seconds, 300 for secret creation and key or certificate import combined. A subscription gets five times the vault limit |\n| Limits | 25 KB a secret, 25 results a list page, no cap on secrets or versions in a vault. Backup fails above 500 versions |\n| Deletion | Soft delete keeps deleted vaults and secrets recoverable for 7 to 90 days (90 by default). Purge protection blocks early purging |\n| Rotation | Keys rotate by policy. Secrets rotate through an Event Grid near-expiry event, raised 30 days before expiry, and an Azure Function the owner supplies |\n| Audit | AuditEvent logs through a diagnostic setting to a storage account, event hub or Azure Monitor, with caller identity and IP address, readable within 10 minutes. Not on by default |\n| SLA | 99.99% monthly uptime for transactions other than creating, updating or deleting vaults, keys or secrets. Credits of 10% below 99.99% and 25% below 99% |\n| Tiers | Standard (software cryptography validated to FIPS 140 Level 1) and Premium (keys in HSMs validated to FIPS 140-3 Level 3). Secrets cost the same in both |\n| SDKs | Python azure-keyvault-secrets 4.11.3 (2 October 2026), JavaScript @azure/keyvault-secrets 4.11.2, .NET Azure.Security.KeyVault.Secrets 4.11.2, Go azsecrets v1.5.0, and Java. MIT |\n| MCP server | None dedicated. The Azure MCP Server, listed separately, has Key Vault secret, key and certificate tools with consent prompts and a read-only mode |\n| Capabilities | secrets.store, secrets.machine-identity, secrets.audit, secrets.rotate, infra.azure |\n| Tags | hosted, closed-source, usage-priced, card-required, openapi, oauth, python, typescript, go, dotnet, java, enterprise, sla, eu |\n| JSON | https://www.anchorterminal.com/api/v1/tools/azure-key-vault.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 87 | 17.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 85 | 13.8 |\n| Agent ergonomics | 13% | 16.2 | 75 | 12.2 |\n| Security \u0026 auth | 14% | 17.5 | 86 | 15.1 |\n| Payments \u0026 pricing | 10% | 12.5 | 20 | 2.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 80 | 7.0 |\n| Transparency \u0026 trust (editorial 67, provenance 86) | 7% | 8.8 | 77 | 6.7 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **74.7 → BB** |\n\n### Why each score\n\n- Reliability 87: Hosted reading. Azure status page with a history of post-incident reviews (20). The history lists three incidents in the last 90 days, West US network connectivity on 23 July 2026 (14:44 to 19:41 UTC), Azure OpenAI and Cognitive Services in Sweden Central on 29 September, and gateway services in several regions on 30 September. None names Key Vault. The page lists only broad incidents and the West US fault blocked traffic entering or leaving that region, so we count the record as minor (20 of 30). Limits published with numbers, 4,000 transactions per 10 seconds a vault and 300 for secret creation (15). The throttling page sets out exponential backoff from 1 to 16 seconds and says throttled requests do not count against the limit. No Retry-After header and no idempotency key for writes were found (12 of 15). The SLA document of 1 October 2026 commits to 99.99 per cent with 10 and 25 per cent credits (10). Generally available (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 85: A public OpenAPI 2.0 document for the secrets data plane, version 2025-07-01, with 12 operations (25). learn.microsoft.com/llms.txt returns 404, but every Learn page we asked for with `Accept: text/markdown` came back as Markdown, so half (5 of 10). Each operation states its purpose and the permission it needs, and the throttling page says when not to use Key Vault, such as for customers' secrets at high throughput (16 of 20). A pattern on secret names, a 1 to 25 range on `maxresults` and an enum for the recovery level. The value is a free string and tags a free object (13 of 15). Sample requests and responses on each reference page. Errors appear only as a generic KeyVaultError, with a separate page for 401, 403 and 429 (11 of 15). Dated `api-version` values and a what's new page, whose newest entry is March 2026 (15).\n- Agent ergonomics 75: API reading. Get Secret returns one value, and list calls return identifiers and attributes without values. There is no field selection (20 of 25). `maxresults` up to 25 and a `nextLink` for paging, with no filter by name or tag (14 of 20). Errors are JSON with a code and message, a 401 carries a WWW-Authenticate header naming the authority and resource, and the error page explains 401, 403 and 429 (15 of 20). Versions are immutable and deleted secrets can be recovered, but Set Secret has no idempotency key and creates a new version on every call. Key Vault has no MCP server of its own to annotate. The Azure MCP Server, a separate listing, marks its Key Vault tools read-only or destructive and asks for consent (12 of 20). SDKs for Python, JavaScript, .NET, Java and Go, and a read needs only the vault and secret name. `api-version` is required on every REST call (14 of 15).\n- Security \u0026 auth 86: Microsoft Entra ID OAuth 2.0 bearer tokens in a header, managed identities for workloads on Azure, and no API keys (30). Key Vault Secrets User reads secret contents only, Key Vault Reader sees metadata only, roles can be assigned on one secret, purging needs its own role, and deleted secrets stay recoverable for 7 to 90 days. Nothing asks for approval on a write (18 of 20). The service returns no untrusted content (10). AuditEvent logs record each operation with caller identity and IP address, but only after the owner adds a diagnostic setting (12 of 15). MSRC coordinated disclosure and bounty policies and a SOC 2 Type 2 report covering Azure. The microsoft.com security.txt passed its Expires date on 23 September 2026, and we could not confirm Key Vault on the audit scope list (16 of 20).\n- Payments \u0026 pricing 20: No x402, MPP or L402 (0). $0.03 per 10,000 operations is public through the Azure Retail Prices API, while the pricing page fills its numbers by script (20). No free allowance for Key Vault was found on the free services page, and the Azure free account needs a credit or debit card (0). A person signs up in a browser with a phone number and a card (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 80: Read as a closed service with official SDKs. azure-keyvault-secrets 4.11.3 reached PyPI on 2 October 2026 (30). Three Python releases in the last 90 days, 4.11.1 on 12 August, 4.11.2 on 25 August and 4.11.3 on 2 October (20). A public what's new page whose newest entry is March 2026, Microsoft Q\u0026A and the SDK issue trackers on GitHub, which we did not read (10 of 15). Official SDKs current in Python, JavaScript, .NET, Go and Java (15). The SDKs are released from the azure-sdk monorepos, CI not checked (5 of 10).\n- Transparency \u0026 trust 77: Closed service under Microsoft's Product Terms, with MIT client libraries (15 of 30). The privacy statement, last updated September 2026, sends Azure customer data to the Product Terms and the Data Protection Addendum. The Key Vault docs say Microsoft doesn't see or extract your data and that logs stay in storage the customer owns. We did not read the addendum itself (22 of 30). Microsoft's Modern Lifecycle Policy promises 12 months' notice before support ends, and Key Vault gives a dated retirement, 27 February 2027, for control plane API versions before 2026-02-01 (18 of 20). Replication stays within the region and its paired region in the same geography. The sub-processor list sits on the Service Trust Portal, a script-drawn page we could not read (12 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (19 items): https://www.anchorterminal.com/fixes/azure-key-vault.md (JSON https://www.anchorterminal.com/fixes/azure-key-vault.json)\n\n### What we couldn't check\n\n- The lead was right on the interface and the docs. Its URL redirects to https://azure.microsoft.com/en-us/products/key-vault.\n- unchecked: whether Key Vault is on Azure's SOC 2 audit scope list. The scope page we loaded did not name services, and the reports sit on the Service Trust Portal.\n- unchecked: the Microsoft sub-processor list and the Data Protection Addendum. The Service Trust Portal page is drawn by script and the addendum page did not load.\n- unchecked: the Azure bounty programme page, which answered 403. The bounty policy link comes from security.txt.\n- unchecked: incidents limited to one region or one service, since the public status history lists only broad incidents.\n- unchecked: CI and open issues for the azure-sdk repositories.\n- The Python changelog on GitHub still marks 4.11.3 as unreleased, while PyPI shows it uploaded on 2 October 2026. lastRelease follows PyPI.\n- Not established: whether 429 responses carry a Retry-After header, and whether throttled calls are billed.\n- The Product Terms page showed no effective date when read.\n\n### Sources\n\n- what's new: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/whats-new\u003e (seen 2026-10-08)\n- service limits: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/service-limits\u003e (seen 2026-10-08)\n- throttling guidance: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/overview-throttling\u003e (seen 2026-10-08)\n- authentication: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/authentication\u003e (seen 2026-10-08)\n- Azure RBAC guide: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide\u003e (seen 2026-10-08)\n- logging: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/logging\u003e (seen 2026-10-08)\n- soft delete: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview\u003e (seen 2026-10-08)\n- about secrets: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets\u003e (seen 2026-10-08)\n- autorotation: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/autorotation\u003e (seen 2026-10-08)\n- reliability and failover: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance\u003e (seen 2026-10-08)\n- API version retirement: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/migrate-api-version\u003e (seen 2026-10-08)\n- REST error codes: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/rest-error-codes\u003e (seen 2026-10-08)\n- REST reference, Get Secret: \u003chttps://learn.microsoft.com/en-us/rest/api/keyvault/secrets/get-secret/get-secret\u003e (seen 2026-10-08)\n- REST reference, Set Secret: \u003chttps://learn.microsoft.com/en-us/rest/api/keyvault/secrets/set-secret/set-secret\u003e (seen 2026-10-08)\n- OpenAPI document, secrets 2025-07-01: \u003chttps://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/keyvault/data-plane/Secrets/stable/2025-07-01/secrets.json\u003e (seen 2026-10-08)\n- retail prices, East US: \u003chttps://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20%27Key%20Vault%27%20and%20armRegionName%20eq%20%27eastus%27\u003e (seen 2026-10-08)\n- pricing page: \u003chttps://azure.microsoft.com/en-us/pricing/details/key-vault/\u003e (seen 2026-10-08)\n- Azure free account: \u003chttps://azure.microsoft.com/en-us/pricing/purchase-options/azure-account\u003e (seen 2026-10-08)\n- free services: \u003chttps://azure.microsoft.com/en-us/pricing/free-services\u003e (seen 2026-10-08)\n- SLA for Online Services, 1 October 2026: \u003chttps://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services\u003e (seen 2026-10-08)\n- status history: \u003chttps://azure.status.microsoft/en-us/status/history/\u003e (seen 2026-10-08)\n- security.txt: \u003chttps://www.microsoft.com/.well-known/security.txt\u003e (seen 2026-10-08)\n- Product Terms for Online Services: \u003chttps://www.microsoft.com/licensing/terms/product/ForOnlineServices/all\u003e (seen 2026-10-08)\n- Online Subscription Agreement: \u003chttps://azure.microsoft.com/en-us/support/legal/subscription-agreement/\u003e (seen 2026-10-08)\n- privacy statement: \u003chttps://www.microsoft.com/en-us/privacy/privacystatement\u003e (seen 2026-10-08)\n- Modern Lifecycle Policy: \u003chttps://learn.microsoft.com/en-us/lifecycle/policies/modern\u003e (seen 2026-10-08)\n- SOC 2 offering: \u003chttps://learn.microsoft.com/en-us/azure/compliance/offerings/offering-soc-2\u003e (seen 2026-10-08)\n- Python SDK on PyPI: \u003chttps://pypi.org/project/azure-keyvault-secrets/\u003e (seen 2026-10-08)\n- Python SDK changelog: \u003chttps://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md\u003e (seen 2026-10-08)\n- JavaScript SDK on npm: \u003chttps://registry.npmjs.org/@azure/keyvault-secrets\u003e (seen 2026-10-08)\n- Azure MCP Server commands: \u003chttps://github.com/microsoft/mcp/blob/main/servers/Azure.Mcp.Server/docs/azmcp-commands.md\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 86/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Microsoft Corporation | 20/20 |\n| Domain age | microsoft.com, registered 1991-05-02 (35 years) | 15/15 |\n| Endpoint on the vendor's domain | \u003cvault-name\u003e.vault.azure.net | 15/15 |\n| Terms of service | read, states 4 of the 7 things a reader expects, and has 2 clauses that cost points | 3.4/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects, and has 1 clause that costs points | 8/10 |\n| Status page | azure.status.microsoft/en-us/status | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | published but past its Expires date | 5/10 |\n\nVaults answer at \u003cvault-name\u003e.vault.azure.net and management calls at management.azure.com, both Microsoft domains. Docs are on learn.microsoft.com.\n\nThe Product Terms for Online Services cover Microsoft Azure, point to the Data Protection Addendum for customer data and to aka.ms/CSLA for the SLA. The page showed no effective date when read on 8 October 2026.\n\nSelf-serve Azure accounts also accept the Microsoft Online Subscription Agreement (last updated March 2019, Microsoft Corporation, Washington law) at https://azure.microsoft.com/en-us/support/legal/subscription-agreement/, which incorporates the Online Services Terms and the SLAs.\n\nThe privacy statement (last updated September 2026) names Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, and Microsoft Ireland Operations Limited in Dublin. It lists Microsoft Azure among the enterprise online services and says the customer's agreement controls where the two conflict.\n\nhttps://www.microsoft.com/.well-known/security.txt shows Expires 2026-09-23T16:00:00.000Z. It points to the MSRC researcher portal, the bounty policy and the coordinated disclosure policy.\n\nRDAP for microsoft.com gives a registration date of 1991-05-02.\n\nThe what's new page is dated 8 September 2026 and its newest entry is March 2026.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all), read 2026-10-08, gives no date, states 4 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"Customer may not use web scraping, web harvesting, or other data extraction methods to extract data from a Microsoft Generative AI Service.\"\n- To know. Restricts benchmarking or competitive use (costs points). \"If Customer offers a product or service competitive to an Online Service, by using the Online Service, Customer waives any restrictions on competitive use and benchmark testing in the terms governing its competitive products and services.\"\n- Not found in the text. Gives the date it was last updated.\n- Not found in the text. Names the governing law or courts.\n- Not found in the text. Says how changes to the terms are announced.\n- Also in the text (2026-10-08). A subscription that is not renewed can continue month by month, and Microsoft may invoice that period at the monthly price plus a three per cent uplift for certain Products. \"Microsoft reserves the right to invoice Customer for the Extended Term at the then-current published price for a monthly subscription plus a three (3) percent uplift for certain Products.\"\n- Also in the text (2026-10-08). After an account is disabled, the customer has 90 days to extract Customer Data and the subscription cannot be reactivated. \"Customer will have 90 days to extract Customer Data from a disabled account, but the Subscription cannot be reactivated.\"\n- Also in the text (2026-10-08). The customer is responsible for any application or AI agent it creates with Microsoft AI Services, including legal, regulatory and licensing compliance. \"Customer is responsible for the design, development and use of any application or AI agent it creates using or for use with Microsoft AI Services, including complying with any legal, regulatory, or licensing requirements applicable to the resulting application or AI agent or its use.\"\n\n**Privacy policy** (https://www.microsoft.com/en-us/privacy/privacystatement), read 2026-10-08, dated 2026-09-01, states 8 of the 8 things a reader expects.\n\n- To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). \"As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models.\"\n- To know. Says it sells personal data or shares it for advertising. \"We also disclose personal data for digital advertising purposes.\"\n- Gives the date it was last updated. Last updated 2026-09-01.\n- Says how long data is kept. Names a period of 7 days.\n- Gives a privacy contact. Names a data protection officer.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n- Also in the text (2026-10-08). For enterprise and developer products, the customer's agreement with Microsoft takes precedence over this privacy statement where the two conflict. \"In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control.\"\n- Also in the text (2026-10-08). Prompts and related data sent to the consumer Microsoft Copilot are used to improve services and for relevant advertising. \"Microsoft Copilot also uses prompts and related data to provide and improve services, including relevant advertising.\"\n- Also in the text (2026-10-08). Microsoft staff manually review some results of its automated systems, including AI, against the source data. \"For example, to build, train, and improve the accuracy of our automated systems – such as AI - we manually review some of the results against the underlying data.\"\n\n## Live (updated 2026-10-08 20:21 UTC)\n\n- Right now: down, n/a, checked 2026-10-08 20:21 UTC (get on `https://\u003cvault-name\u003e.vault.azure.net`)\n- Uptime 24h 0.0% (32 probes) · 30 days 0.0% (32 probes) · p50 n/a · p95 n/a\n- Watching changelog \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/whats-new\u003e\n- Watching pricing \u003chttps://azure.microsoft.com/en-us/pricing/purchase-options/azure-account\u003e\n- Watching pricing \u003chttps://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20%27Key%20Vault%27%20and%20armRegionName%20eq%20%27eastus%27\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/azure-key-vault.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Secrets operations | $0.003 | per 1,000 tool calls | $0.03 per 10,000 operations, East US, Standard and Premium |\n| Certificate renewal request | $3 | per transaction | Per renewal request |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- No API keys. Every call carries a Microsoft Entra ID bearer token, and managed identities remove stored credentials for workloads on Azure\n- Azure roles can be assigned on a vault or one secret, with Key Vault Secrets User limited to reading secret contents\n- Deleted secrets stay recoverable for 7 to 90 days, and purging needs a separate permission\n- SLA of 99.99 per cent uptime for read transactions, with 10 and 25 per cent credits, in the 1 October 2026 SLA document\n- Public OpenAPI 2.0 contract for the 12 secrets operations, and Learn pages returned as Markdown on request\n\n## Weaknesses\n\n- No managed rotation for secrets. Key Vault raises a near-expiry event 30 days ahead and the owner's Azure Function does the rotation\n- Audit logging is off until a diagnostic setting sends AuditEvent logs to a storage account, event hub or Azure Monitor\n- Set Secret has no idempotency key, so a retried write adds another version\n- Listing returns at most 25 secrets a page with no name or tag filter\n- No free allowance for Key Vault was found, and an Azure account needs a phone number and a credit or debit card\n\n## Before you call it (notes for agents)\n\n1. Request a token for the resource https://vault.azure.net and send it as a Bearer header. Every call must carry `api-version`, such as 2025-07-01, because there is no default\n2. Ask for the Key Vault Secrets User role on the vault or the single secret. Key Vault Reader returns metadata only, not values\n3. Cache secret values in memory. A vault allows 4,000 reads and 300 secret creations per 10 seconds, and a subscription five times that\n4. On 429 wait 1, 2, 4, 8 then 16 seconds. Throttled requests do not count against the limit\n5. Don't retry Set Secret blindly. Each successful call creates a new version of the secret\n\n## Connect\n\nInstall:\n\n```bash\npip install azure-keyvault-secrets azure-identity # or: npm i @azure/keyvault-secrets @azure/identity\n```\n\nFirst request:\n\n```bash\nGET https://\u003cvault-name\u003e.vault.azure.net/secrets/\u003csecret-name\u003e?api-version=2025-07-01\nAuthorization: Bearer \u003cEntra ID access token for https://vault.azure.net\u003e\n```\n\nThrough letme (picks today, calling later): https://letme.dev/azure-key-vault (letme picks it for infra.azure, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Infisical | A | 83.7 | 2 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/infisical.md |\n| AWS Secrets Manager | BB | 77.7 | 18 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/aws-secrets-manager.md |\n| Google Cloud Secret Manager | BB | 76.5 | 28 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/google-secret-manager.md |\n| Akeyless (SecretlessAI and MCP server) | BB | 73.6 | 74 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/akeyless.md |\n| Doppler | BB | 71.4 | 110 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/doppler.md |\n| Pulumi ESC | BB | 71.1 | 120 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/pulumi-esc.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The secrets data plane has 12 operations at https://\u003cvault-name\u003e.vault.azure.net, newest stable API version 2025-07-01, with a preview 2026-07-01-preview in the specs repository (source: \u003chttps://github.com/Azure/azure-rest-api-specs/tree/main/specification/keyvault/data-plane/Secrets\u003e)\n- A vault allows 4,000 transactions per 10 seconds, 300 for secret creation and key or certificate import combined, and a subscription five times the vault limit (source: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/service-limits\u003e)\n- Azure RBAC is the default access model for vaults created with control plane API 2026-02-01, and control plane versions before it retire on 27 February 2027 (source: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/whats-new\u003e)\n- Attribute-based conditions on role assignments, such as secrets whose names match a pattern, are in preview and apply only to secret data actions (source: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide\u003e)\n- Vault contents replicate within the region and, where the paired region is in the same geography, to that region. After a Microsoft-managed failover the vault is read-only (source: \u003chttps://learn.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance\u003e)\n- Microsoft's Azure MCP Server, listed separately, has `keyvault secret get` and `keyvault secret create` tools that ask the user for consent before returning or writing a secret value (source: \u003chttps://github.com/microsoft/mcp/blob/main/servers/Azure.Mcp.Server/docs/azmcp-commands.md\u003e)\n- azure-keyvault-secrets 4.11.1 and 4.11.2 (12 and 25 August 2026) fixed bugs in the SDK's authentication challenge handling, one of which let a request's method, URL and body reach a later request on the same client (source: \u003chttps://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md\u003e)\n\n## Compare\n\n- [1Password service accounts, SDKs and Environments MCP vs Azure Key Vault](https://www.anchorterminal.com/compare/1password-vs-azure-key-vault.md): B 69.7 vs BB 74.7\n- [Akeyless (SecretlessAI and MCP server) vs Azure Key Vault](https://www.anchorterminal.com/compare/akeyless-vs-azure-key-vault.md): BB 73.6 vs BB 74.7\n- [AWS Secrets Manager vs Azure Key Vault](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-azure-key-vault.md): BB 77.7 vs BB 74.7\n- [Azure Key Vault vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/azure-key-vault-vs-bitwarden-secrets-manager.md): BB 74.7 vs C 56.8\n- [Azure Key Vault vs Doppler](https://www.anchorterminal.com/compare/azure-key-vault-vs-doppler.md): BB 74.7 vs BB 71.4\n- [Azure Key Vault vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/azure-key-vault-vs-google-secret-manager.md): BB 74.7 vs BB 76.5\n- [Azure Key Vault vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/azure-key-vault-vs-hashicorp-vault.md): BB 74.7 vs B 64.2\n- [Azure Key Vault vs Infisical](https://www.anchorterminal.com/compare/azure-key-vault-vs-infisical.md): BB 74.7 vs A 83.7\n- [Azure Key Vault vs Keeper Secrets Manager](https://www.anchorterminal.com/compare/azure-key-vault-vs-keeper-secrets-manager.md): BB 74.7 vs B 69.4\n- [Azure Key Vault vs Phase](https://www.anchorterminal.com/compare/azure-key-vault-vs-phase.md): BB 74.7 vs B 68\n- [Azure Key Vault vs Pulumi ESC](https://www.anchorterminal.com/compare/azure-key-vault-vs-pulumi-esc.md): BB 74.7 vs BB 71.1\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on microsoft.com or one of its subdomains, or the README of github.com/Azure/azure-rest-api-specs. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"azure-key-vault\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/azure-key-vault\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/azure-key-vault.svg\" alt=\"Azure Key Vault on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Azure Key Vault on Anchor Terminal](https://www.anchorterminal.com/badges/azure-key-vault.svg)](https://www.anchorterminal.com/tools/azure-key-vault)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/azure-key-vault\"\u003eAzure Key Vault on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Azure Key Vault is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/azure-key-vault-dark.png\n- Light: https://www.anchorterminal.com/assets/share/azure-key-vault-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Secrets \u0026 credential vaults", "url": "https://www.anchorterminal.com/categories/secrets" }, { "name": "Azure Key Vault", "url": "" } ], "description": "Microsoft Azure's managed store for secrets, encryption keys and TLS certificates. Applications read secrets over a REST API or the Azure SDKs and CLI, signing in with Microsoft Entra ID and authorised by Azure role assignments.", "facts": [ "rank #60 of 722", "OAuth auth", "0 desk reviews" ], "h1": "Azure Key Vault", "image": "https://www.anchorterminal.com/assets/og/tools-azure-key-vault.png", "path": "/tools/azure-key-vault", "published": "2026-10-01", "section": "tools", "title": "Azure Key Vault review for AI agents, grade BB (74.7/100)", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/azure-key-vault" }, "tokens": { "markdown": 9200, "slim": 1730 }, "version": 1 }