# Azure Key Vault > Microsoft Azure's managed store for secrets, encryption keys and TLS certificates. Applications read secrets over a REST API or the Azure SDKs and CLI, signing in with Microsoft Entra ID and authorised by Azure role assignments. - Canonical: https://www.anchorterminal.com/tools/azure-key-vault - Markdown: https://www.anchorterminal.com/tools/azure-key-vault.md (~9,200 tokens) - Slim: https://www.anchorterminal.com/tools/azure-key-vault.min.md (~1,730 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/azure-key-vault.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-08 ## Overview **Grade BB · 74.7/100 · rank #60 of 722 · #4 in Secrets & credential vaults · agent-ready · confidence medium** More from Microsoft Corporation, listed separately because each is its own product: [Microsoft Foundry fine-tuning (Azure OpenAI)](https://www.anchorterminal.com/tools/azure-foundry-fine-tuning.md) (Fine-tuning), [Azure AI Content Safety (Prompt Shields)](https://www.anchorterminal.com/tools/azure-ai-content-safety.md) (Guardrails & safety filters), [Azure AI Speech speech-to-text](https://www.anchorterminal.com/tools/azure-speech-to-text.md) (Speech-to-text), [Azure AI Speech text-to-speech](https://www.anchorterminal.com/tools/azure-text-to-speech.md) (Text-to-speech), [Microsoft Agent Framework](https://www.anchorterminal.com/tools/microsoft-agent-framework.md) (Agent frameworks & SDKs), [Microsoft Execution Containers](https://www.anchorterminal.com/tools/microsoft-execution-containers.md) (Code execution sandboxes), [Microsoft Entra Agent ID](https://www.anchorterminal.com/tools/microsoft-entra-agent-id.md) (Agent auth & delegated access), [Azure DevOps MCP Server](https://www.anchorterminal.com/tools/azure-devops-mcp.md) (Code & developer platforms), [Microsoft Learn MCP Server](https://www.anchorterminal.com/tools/microsoft-learn-mcp.md) (Code & developer platforms), [Playwright MCP](https://www.anchorterminal.com/tools/playwright-mcp.md) (Browser automation), [Azure MCP Server](https://www.anchorterminal.com/tools/azure-mcp.md) (Cloud & infrastructure), [Azure Maps](https://www.anchorterminal.com/tools/azure-maps.md) (Maps, geocoding & places), [Azure Translator](https://www.anchorterminal.com/tools/azure-translator.md) (Translation), [Microsoft Graph Calendar API](https://www.anchorterminal.com/tools/microsoft-graph-calendar.md) (Calendars & scheduling), [Microsoft Teams (Microsoft Graph)](https://www.anchorterminal.com/tools/microsoft-teams.md) (Work & productivity), [Microsoft Dynamics 365 Sales](https://www.anchorterminal.com/tools/dynamics-365-sales.md) (CRM & customer platforms), [Microsoft Power Automate](https://www.anchorterminal.com/tools/power-automate.md) (Workflow automation), [Microsoft Advertising API](https://www.anchorterminal.com/tools/microsoft-advertising-api.md) (Advertising & campaign operations), [Microsoft Excel (Microsoft Graph workbook API)](https://www.anchorterminal.com/tools/microsoft-excel-graph.md) (Spreadsheets & operational tables), [Outlook Mail (Microsoft Graph)](https://www.anchorterminal.com/tools/outlook-mail-graph.md) (Mailbox access). ## Assessment Access runs on Microsoft Entra ID tokens and Azure roles that can be scoped to one secret, with soft delete, a 99.99 per cent SLA and a public OpenAPI contract. Secret rotation needs an Event Grid trigger and a function the owner writes, audit logging is off until enabled, and an Azure subscription needs a person and a payment card. ## Facts | Field | Value | | --- | --- | | Vendor | Microsoft Corporation (https://azure.microsoft.com/en-us/products/key-vault) | | Kind | HTTP API | | Category | Secrets & credential vaults (https://www.anchorterminal.com/categories/secrets) | | Transport | HTTP | | Endpoint | `https://.vault.azure.net` | | Auth | OAuth · Every data plane call carries a Microsoft Entra ID OAuth 2.0 bearer token for the scope https://vault.azure.net/.default. There are no API keys. A workload on Azure uses a managed identity, and anything else uses a service principal registered in the vault's Entra tenant. Access is self-serve inside an Azure subscription. An owner assigns a role such as Key Vault Secrets User (read secret contents) or Key Vault Secrets Officer at subscription, resource group, vault or single-secret scope. Legacy vault access policies still work, and Microsoft's guidance says not to use them for critical data (https://learn.microsoft.com/en-us/azure/key-vault/general/authentication, https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide). | | Pricing | Pay per use ($0.003 / 1k calls) · $0.03 per 10,000 operations on secrets in both the Standard and Premium tiers in East US, with no charge per stored secret. Renewal of a managed storage account key is metered at $1, and a certificate renewal request at $3. The pricing page draws its numbers by script, so these come from the Azure Retail Prices API (https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20%27Key%20Vault%27%20and%20armRegionName%20eq%20%27eastus%27). No free allowance for Key Vault was found on the free services page. A new Azure account gets $200 of credit for 30 days and needs a phone number and a credit or debit card (https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account). | | x402 | No · No x402, MPP or L402 in the Key Vault docs, the REST reference or the pricing page (checked 2026-10-08). | | Licence | Proprietary service under Microsoft's Product Terms. The Azure SDK client libraries are MIT | | Packages | pypi: `azure-keyvault-secrets`; npm: `@azure/keyvault-secrets`; go: `github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets` | | Source | https://github.com/Azure/azure-rest-api-specs | | Docs | https://learn.microsoft.com/en-us/azure/key-vault/ | | llms.txt | not found | | Last release | 2026-10-02 | | npm downloads / week | 2,598,246 | | PyPI downloads / week | 9,507,749 | | API | REST data plane at https://.vault.azure.net, 12 secrets operations (get, set, update, delete, list, versions, backup, restore, and four for deleted secrets). Stable API version 2025-07-01. Vaults are created through Azure Resource Manager, control plane version 2026-02-01 | | Credentials | Microsoft Entra ID bearer tokens only. Managed identities on Azure, service principals elsewhere. Roles assignable down to one secret | | Rate limits | Per vault per region, 4,000 transactions per 10 seconds, 300 for secret creation and key or certificate import combined. A subscription gets five times the vault limit | | Limits | 25 KB a secret, 25 results a list page, no cap on secrets or versions in a vault. Backup fails above 500 versions | | Deletion | Soft delete keeps deleted vaults and secrets recoverable for 7 to 90 days (90 by default). Purge protection blocks early purging | | Rotation | Keys rotate by policy. Secrets rotate through an Event Grid near-expiry event, raised 30 days before expiry, and an Azure Function the owner supplies | | Audit | AuditEvent logs through a diagnostic setting to a storage account, event hub or Azure Monitor, with caller identity and IP address, readable within 10 minutes. Not on by default | | SLA | 99.99% monthly uptime for transactions other than creating, updating or deleting vaults, keys or secrets. Credits of 10% below 99.99% and 25% below 99% | | Tiers | Standard (software cryptography validated to FIPS 140 Level 1) and Premium (keys in HSMs validated to FIPS 140-3 Level 3). Secrets cost the same in both | | SDKs | Python azure-keyvault-secrets 4.11.3 (2 October 2026), JavaScript @azure/keyvault-secrets 4.11.2, .NET Azure.Security.KeyVault.Secrets 4.11.2, Go azsecrets v1.5.0, and Java. MIT | | MCP server | None dedicated. The Azure MCP Server, listed separately, has Key Vault secret, key and certificate tools with consent prompts and a read-only mode | | Capabilities | secrets.store, secrets.machine-identity, secrets.audit, secrets.rotate, infra.azure | | Tags | hosted, closed-source, usage-priced, card-required, openapi, oauth, python, typescript, go, dotnet, java, enterprise, sla, eu | | JSON | https://www.anchorterminal.com/api/v1/tools/azure-key-vault.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 87 | 17.4 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 85 | 13.8 | | Agent ergonomics | 13% | 16.2 | 75 | 12.2 | | Security & auth | 14% | 17.5 | 86 | 15.1 | | Payments & pricing | 10% | 12.5 | 20 | 2.5 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 80 | 7.0 | | Transparency & trust (editorial 67, provenance 86) | 7% | 8.8 | 77 | 6.7 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **74.7 → BB** | ### Why each score - Reliability 87: Hosted reading. Azure status page with a history of post-incident reviews (20). The history lists three incidents in the last 90 days, West US network connectivity on 23 July 2026 (14:44 to 19:41 UTC), Azure OpenAI and Cognitive Services in Sweden Central on 29 September, and gateway services in several regions on 30 September. None names Key Vault. The page lists only broad incidents and the West US fault blocked traffic entering or leaving that region, so we count the record as minor (20 of 30). Limits published with numbers, 4,000 transactions per 10 seconds a vault and 300 for secret creation (15). The throttling page sets out exponential backoff from 1 to 16 seconds and says throttled requests do not count against the limit. No Retry-After header and no idempotency key for writes were found (12 of 15). The SLA document of 1 October 2026 commits to 99.99 per cent with 10 and 25 per cent credits (10). Generally available (10). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 85: A public OpenAPI 2.0 document for the secrets data plane, version 2025-07-01, with 12 operations (25). learn.microsoft.com/llms.txt returns 404, but every Learn page we asked for with `Accept: text/markdown` came back as Markdown, so half (5 of 10). Each operation states its purpose and the permission it needs, and the throttling page says when not to use Key Vault, such as for customers' secrets at high throughput (16 of 20). A pattern on secret names, a 1 to 25 range on `maxresults` and an enum for the recovery level. The value is a free string and tags a free object (13 of 15). Sample requests and responses on each reference page. Errors appear only as a generic KeyVaultError, with a separate page for 401, 403 and 429 (11 of 15). Dated `api-version` values and a what's new page, whose newest entry is March 2026 (15). - Agent ergonomics 75: API reading. Get Secret returns one value, and list calls return identifiers and attributes without values. There is no field selection (20 of 25). `maxresults` up to 25 and a `nextLink` for paging, with no filter by name or tag (14 of 20). Errors are JSON with a code and message, a 401 carries a WWW-Authenticate header naming the authority and resource, and the error page explains 401, 403 and 429 (15 of 20). Versions are immutable and deleted secrets can be recovered, but Set Secret has no idempotency key and creates a new version on every call. Key Vault has no MCP server of its own to annotate. The Azure MCP Server, a separate listing, marks its Key Vault tools read-only or destructive and asks for consent (12 of 20). SDKs for Python, JavaScript, .NET, Java and Go, and a read needs only the vault and secret name. `api-version` is required on every REST call (14 of 15). - Security & auth 86: Microsoft Entra ID OAuth 2.0 bearer tokens in a header, managed identities for workloads on Azure, and no API keys (30). Key Vault Secrets User reads secret contents only, Key Vault Reader sees metadata only, roles can be assigned on one secret, purging needs its own role, and deleted secrets stay recoverable for 7 to 90 days. Nothing asks for approval on a write (18 of 20). The service returns no untrusted content (10). AuditEvent logs record each operation with caller identity and IP address, but only after the owner adds a diagnostic setting (12 of 15). MSRC coordinated disclosure and bounty policies and a SOC 2 Type 2 report covering Azure. The microsoft.com security.txt passed its Expires date on 23 September 2026, and we could not confirm Key Vault on the audit scope list (16 of 20). - Payments & pricing 20: No x402, MPP or L402 (0). $0.03 per 10,000 operations is public through the Azure Retail Prices API, while the pricing page fills its numbers by script (20). No free allowance for Key Vault was found on the free services page, and the Azure free account needs a credit or debit card (0). A person signs up in a browser with a phone number and a card (0). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 80: Read as a closed service with official SDKs. azure-keyvault-secrets 4.11.3 reached PyPI on 2 October 2026 (30). Three Python releases in the last 90 days, 4.11.1 on 12 August, 4.11.2 on 25 August and 4.11.3 on 2 October (20). A public what's new page whose newest entry is March 2026, Microsoft Q&A and the SDK issue trackers on GitHub, which we did not read (10 of 15). Official SDKs current in Python, JavaScript, .NET, Go and Java (15). The SDKs are released from the azure-sdk monorepos, CI not checked (5 of 10). - Transparency & trust 77: Closed service under Microsoft's Product Terms, with MIT client libraries (15 of 30). The privacy statement, last updated September 2026, sends Azure customer data to the Product Terms and the Data Protection Addendum. The Key Vault docs say Microsoft doesn't see or extract your data and that logs stay in storage the customer owns. We did not read the addendum itself (22 of 30). Microsoft's Modern Lifecycle Policy promises 12 months' notice before support ends, and Key Vault gives a dated retirement, 27 February 2027, for control plane API versions before 2026-02-01 (18 of 20). Replication stays within the region and its paired region in the same geography. The sub-processor list sits on the Service Trust Portal, a script-drawn page we could not read (12 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (19 items): https://www.anchorterminal.com/fixes/azure-key-vault.md (JSON https://www.anchorterminal.com/fixes/azure-key-vault.json) ### What we couldn't check - The lead was right on the interface and the docs. Its URL redirects to https://azure.microsoft.com/en-us/products/key-vault. - unchecked: whether Key Vault is on Azure's SOC 2 audit scope list. The scope page we loaded did not name services, and the reports sit on the Service Trust Portal. - unchecked: the Microsoft sub-processor list and the Data Protection Addendum. The Service Trust Portal page is drawn by script and the addendum page did not load. - unchecked: the Azure bounty programme page, which answered 403. The bounty policy link comes from security.txt. - unchecked: incidents limited to one region or one service, since the public status history lists only broad incidents. - unchecked: CI and open issues for the azure-sdk repositories. - The Python changelog on GitHub still marks 4.11.3 as unreleased, while PyPI shows it uploaded on 2 October 2026. lastRelease follows PyPI. - Not established: whether 429 responses carry a Retry-After header, and whether throttled calls are billed. - The Product Terms page showed no effective date when read. ### Sources - what's new: (seen 2026-10-08) - service limits: (seen 2026-10-08) - throttling guidance: (seen 2026-10-08) - authentication: (seen 2026-10-08) - Azure RBAC guide: (seen 2026-10-08) - logging: (seen 2026-10-08) - soft delete: (seen 2026-10-08) - about secrets: (seen 2026-10-08) - autorotation: (seen 2026-10-08) - reliability and failover: (seen 2026-10-08) - API version retirement: (seen 2026-10-08) - REST error codes: (seen 2026-10-08) - REST reference, Get Secret: (seen 2026-10-08) - REST reference, Set Secret: (seen 2026-10-08) - OpenAPI document, secrets 2025-07-01: (seen 2026-10-08) - retail prices, East US: (seen 2026-10-08) - pricing page: (seen 2026-10-08) - Azure free account: (seen 2026-10-08) - free services: (seen 2026-10-08) - SLA for Online Services, 1 October 2026: (seen 2026-10-08) - status history: (seen 2026-10-08) - security.txt: (seen 2026-10-08) - Product Terms for Online Services: (seen 2026-10-08) - Online Subscription Agreement: (seen 2026-10-08) - privacy statement: (seen 2026-10-08) - Modern Lifecycle Policy: (seen 2026-10-08) - SOC 2 offering: (seen 2026-10-08) - Python SDK on PyPI: (seen 2026-10-08) - Python SDK changelog: (seen 2026-10-08) - JavaScript SDK on npm: (seen 2026-10-08) - Azure MCP Server commands: (seen 2026-10-08) ## Who's behind it (provenance 86/100, checked 2026-10-08) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Microsoft Corporation | 20/20 | | Domain age | microsoft.com, registered 1991-05-02 (35 years) | 15/15 | | Endpoint on the vendor's domain | .vault.azure.net | 15/15 | | Terms of service | read, states 4 of the 7 things a reader expects, and has 2 clauses that cost points | 3.4/10 | | Privacy policy | read, states 8 of the 8 things a reader expects, and has 1 clause that costs points | 8/10 | | Status page | azure.status.microsoft/en-us/status | 10/10 | | Changelog | published | 10/10 | | security.txt | published but past its Expires date | 5/10 | Vaults answer at .vault.azure.net and management calls at management.azure.com, both Microsoft domains. Docs are on learn.microsoft.com. The Product Terms for Online Services cover Microsoft Azure, point to the Data Protection Addendum for customer data and to aka.ms/CSLA for the SLA. The page showed no effective date when read on 8 October 2026. Self-serve Azure accounts also accept the Microsoft Online Subscription Agreement (last updated March 2019, Microsoft Corporation, Washington law) at https://azure.microsoft.com/en-us/support/legal/subscription-agreement/, which incorporates the Online Services Terms and the SLAs. The privacy statement (last updated September 2026) names Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, and Microsoft Ireland Operations Limited in Dublin. It lists Microsoft Azure among the enterprise online services and says the customer's agreement controls where the two conflict. https://www.microsoft.com/.well-known/security.txt shows Expires 2026-09-23T16:00:00.000Z. It points to the MSRC researcher portal, the bounty policy and the coordinated disclosure policy. RDAP for microsoft.com gives a registration date of 1991-05-02. The what's new page is dated 8 September 2026 and its newest entry is March 2026. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all), read 2026-10-08, gives no date, states 4 of the 7 things a reader expects. - To know. Restricts automated access (costs points). "Customer may not use web scraping, web harvesting, or other data extraction methods to extract data from a Microsoft Generative AI Service." - To know. Restricts benchmarking or competitive use (costs points). "If Customer offers a product or service competitive to an Online Service, by using the Online Service, Customer waives any restrictions on competitive use and benchmark testing in the terms governing its competitive products and services." - Not found in the text. Gives the date it was last updated. - Not found in the text. Names the governing law or courts. - Not found in the text. Says how changes to the terms are announced. - Also in the text (2026-10-08). A subscription that is not renewed can continue month by month, and Microsoft may invoice that period at the monthly price plus a three per cent uplift for certain Products. "Microsoft reserves the right to invoice Customer for the Extended Term at the then-current published price for a monthly subscription plus a three (3) percent uplift for certain Products." - Also in the text (2026-10-08). After an account is disabled, the customer has 90 days to extract Customer Data and the subscription cannot be reactivated. "Customer will have 90 days to extract Customer Data from a disabled account, but the Subscription cannot be reactivated." - Also in the text (2026-10-08). The customer is responsible for any application or AI agent it creates with Microsoft AI Services, including legal, regulatory and licensing compliance. "Customer is responsible for the design, development and use of any application or AI agent it creates using or for use with Microsoft AI Services, including complying with any legal, regulatory, or licensing requirements applicable to the resulting application or AI agent or its use." **Privacy policy** (https://www.microsoft.com/en-us/privacy/privacystatement), read 2026-10-08, dated 2026-09-01, states 8 of the 8 things a reader expects. - To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). "As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models." - To know. Says it sells personal data or shares it for advertising. "We also disclose personal data for digital advertising purposes." - Gives the date it was last updated. Last updated 2026-09-01. - Says how long data is kept. Names a period of 7 days. - Gives a privacy contact. Names a data protection officer. - Says where data is transferred or stored. Relies on standard contractual clauses. - Also in the text (2026-10-08). For enterprise and developer products, the customer's agreement with Microsoft takes precedence over this privacy statement where the two conflict. "In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control." - Also in the text (2026-10-08). Prompts and related data sent to the consumer Microsoft Copilot are used to improve services and for relevant advertising. "Microsoft Copilot also uses prompts and related data to provide and improve services, including relevant advertising." - Also in the text (2026-10-08). Microsoft staff manually review some results of its automated systems, including AI, against the source data. "For example, to build, train, and improve the accuracy of our automated systems – such as AI - we manually review some of the results against the underlying data." ## Live (updated 2026-10-08 20:21 UTC) - Right now: down, n/a, checked 2026-10-08 20:21 UTC (get on `https://.vault.azure.net`) - Uptime 24h 0.0% (32 probes) · 30 days 0.0% (32 probes) · p50 n/a · p95 n/a - Watching changelog - Watching pricing - Watching pricing - Always current: https://www.anchorterminal.com/api/v1/live/azure-key-vault.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Prices | Item | Price | Unit | Note | | --- | --- | --- | --- | | Secrets operations | $0.003 | per 1,000 tool calls | $0.03 per 10,000 operations, East US, Standard and Premium | | Certificate renewal request | $3 | per transaction | Per renewal request | Across all listings: https://www.anchorterminal.com/prices/index.md ## Strengths - No API keys. Every call carries a Microsoft Entra ID bearer token, and managed identities remove stored credentials for workloads on Azure - Azure roles can be assigned on a vault or one secret, with Key Vault Secrets User limited to reading secret contents - Deleted secrets stay recoverable for 7 to 90 days, and purging needs a separate permission - SLA of 99.99 per cent uptime for read transactions, with 10 and 25 per cent credits, in the 1 October 2026 SLA document - Public OpenAPI 2.0 contract for the 12 secrets operations, and Learn pages returned as Markdown on request ## Weaknesses - No managed rotation for secrets. Key Vault raises a near-expiry event 30 days ahead and the owner's Azure Function does the rotation - Audit logging is off until a diagnostic setting sends AuditEvent logs to a storage account, event hub or Azure Monitor - Set Secret has no idempotency key, so a retried write adds another version - Listing returns at most 25 secrets a page with no name or tag filter - No free allowance for Key Vault was found, and an Azure account needs a phone number and a credit or debit card ## Before you call it (notes for agents) 1. Request a token for the resource https://vault.azure.net and send it as a Bearer header. Every call must carry `api-version`, such as 2025-07-01, because there is no default 2. Ask for the Key Vault Secrets User role on the vault or the single secret. Key Vault Reader returns metadata only, not values 3. Cache secret values in memory. A vault allows 4,000 reads and 300 secret creations per 10 seconds, and a subscription five times that 4. On 429 wait 1, 2, 4, 8 then 16 seconds. Throttled requests do not count against the limit 5. Don't retry Set Secret blindly. Each successful call creates a new version of the secret ## Connect Install: ```bash pip install azure-keyvault-secrets azure-identity # or: npm i @azure/keyvault-secrets @azure/identity ``` First request: ```bash GET https://.vault.azure.net/secrets/?api-version=2025-07-01 Authorization: Bearer ``` Through letme (picks today, calling later): https://letme.dev/azure-key-vault (letme picks it for infra.azure, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | Infisical | A | 83.7 | 2 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/infisical.md | | AWS Secrets Manager | BB | 77.7 | 18 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/aws-secrets-manager.md | | Google Cloud Secret Manager | BB | 76.5 | 28 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/google-secret-manager.md | | Akeyless (SecretlessAI and MCP server) | BB | 73.6 | 74 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/akeyless.md | | Doppler | BB | 71.4 | 110 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/doppler.md | | Pulumi ESC | BB | 71.1 | 120 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | no | https://www.anchorterminal.com/tools/pulumi-esc.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The secrets data plane has 12 operations at https://.vault.azure.net, newest stable API version 2025-07-01, with a preview 2026-07-01-preview in the specs repository (source: ) - A vault allows 4,000 transactions per 10 seconds, 300 for secret creation and key or certificate import combined, and a subscription five times the vault limit (source: ) - Azure RBAC is the default access model for vaults created with control plane API 2026-02-01, and control plane versions before it retire on 27 February 2027 (source: ) - Attribute-based conditions on role assignments, such as secrets whose names match a pattern, are in preview and apply only to secret data actions (source: ) - Vault contents replicate within the region and, where the paired region is in the same geography, to that region. After a Microsoft-managed failover the vault is read-only (source: ) - Microsoft's Azure MCP Server, listed separately, has `keyvault secret get` and `keyvault secret create` tools that ask the user for consent before returning or writing a secret value (source: ) - azure-keyvault-secrets 4.11.1 and 4.11.2 (12 and 25 August 2026) fixed bugs in the SDK's authentication challenge handling, one of which let a request's method, URL and body reach a later request on the same client (source: ) ## Compare - [1Password service accounts, SDKs and Environments MCP vs Azure Key Vault](https://www.anchorterminal.com/compare/1password-vs-azure-key-vault.md): B 69.7 vs BB 74.7 - [Akeyless (SecretlessAI and MCP server) vs Azure Key Vault](https://www.anchorterminal.com/compare/akeyless-vs-azure-key-vault.md): BB 73.6 vs BB 74.7 - [AWS Secrets Manager vs Azure Key Vault](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-azure-key-vault.md): BB 77.7 vs BB 74.7 - [Azure Key Vault vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/azure-key-vault-vs-bitwarden-secrets-manager.md): BB 74.7 vs C 56.8 - [Azure Key Vault vs Doppler](https://www.anchorterminal.com/compare/azure-key-vault-vs-doppler.md): BB 74.7 vs BB 71.4 - [Azure Key Vault vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/azure-key-vault-vs-google-secret-manager.md): BB 74.7 vs BB 76.5 - [Azure Key Vault vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/azure-key-vault-vs-hashicorp-vault.md): BB 74.7 vs B 64.2 - [Azure Key Vault vs Infisical](https://www.anchorterminal.com/compare/azure-key-vault-vs-infisical.md): BB 74.7 vs A 83.7 - [Azure Key Vault vs Keeper Secrets Manager](https://www.anchorterminal.com/compare/azure-key-vault-vs-keeper-secrets-manager.md): BB 74.7 vs B 69.4 - [Azure Key Vault vs Phase](https://www.anchorterminal.com/compare/azure-key-vault-vs-phase.md): BB 74.7 vs B 68 - [Azure Key Vault vs Pulumi ESC](https://www.anchorterminal.com/compare/azure-key-vault-vs-pulumi-esc.md): BB 74.7 vs BB 71.1 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on microsoft.com or one of its subdomains, or the README of github.com/Azure/azure-rest-api-specs. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "azure-key-vault", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html Azure Key Vault on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![Azure Key Vault on Anchor Terminal](https://www.anchorterminal.com/badges/azure-key-vault.svg)](https://www.anchorterminal.com/tools/azure-key-vault) ``` Plain link: ```html Azure Key Vault on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Azure Key Vault is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/azure-key-vault-dark.png - Light: https://www.anchorterminal.com/assets/share/azure-key-vault-light.png