Safeguard and maintain control of keys and other secrets
Azure Key Vault enables Azure subscribers to safeguard and control cryptographic keys and other secrets used by cloud apps and services. Azure Key Vault provides two types of containers:
- Vaults for storing and managing cryptographic keys, secrets, certificates, and storage account keys.
- Managed HSM pool for storing and managing HSM-backed cryptographic keys.
Explore pricing options
Apply filters to customize pricing options to your needs.
Prices are estimates only and are not intended as actual price quotes. Actual pricing may vary depending on the type of agreement entered with Microsoft, date of purchase, and the currency exchange rate. Prices are calculated based on US dollars and converted using London closing spot rates that are captured in the two business days prior to the last business day of the previous month end. If the two business days prior to the end of the month fall on a bank holiday in major markets, the rate setting day is generally the day immediately preceding the two business days. This rate applies to all transactions during the upcoming month. Sign in to the Azure pricing calculator to see pricing based on your current program/offer with Microsoft. Contact an Azure sales specialist for more information on pricing or to request a price quote. See frequently asked questions about Azure pricing.
US government entities are eligible to purchase Azure Government services from a licensing solution provider with no upfront financial commitment, or directly through a pay-as-you-go online subscription.
Important—The price in R$ is merely a reference; this is an international transaction and the final price is subject to exchange rates and the inclusion of IOF taxes. An eNF will not be issued.
US government entities are eligible to purchase Azure Government services from a licensing solution provider with no upfront financial commitment, or directly through a pay-as-you-go online subscription.
Important—The price in R$ is merely a reference; this is an international transaction and the final price is subject to exchange rates and the inclusion of IOF taxes. An eNF will not be issued.
Vaults
Vaults are offered in two service tiers—standard and premium.
| Standard | Premium | |
|---|---|---|
| Secrets operations | $-/10,000 transactions | $-/10,000 transactions |
| Certificate operations1 |
Renewals—$- per renewal request All other operations—$-/10,000 transactions |
Renewals—$- per renewal request All other operations—$-/10,000 transactions |
| Managed Azure Storage account key rotation (in preview) |
Free during preview General availability price—$- per renewal2 |
Free during preview General availability price—$- per renewal2 |
Software-protected keys
| Standard | Premium | |
|---|---|---|
| RSA 2,048-bit keys | $-/10,000 transactions | $-/10,000 transactions |
|
Advanced key types—
RSA 3,072-bit, RSA 4,096-bit, and Elliptic-Curve Cryptography (ECC) keys |
$-/10,000 transactions | $-/10,000 transactions |
HSM-protected keys
| Standard | Premium | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| RSA 2,048-bit keys | N/A | $- per key per month1 + $-/10,000 transactions | ||||||||
|
Advanced key types1—
RSA 3,072-bit, RSA 4,096-bit, and Elliptic-Curve Cryptography (ECC) keys |
N/A |
|
Key Rotation
| Standard | Premium | |
|---|---|---|
| Automated key rotation | $- per scheduled rotation | $- per scheduled rotation |
Managed HSM Pools
| Hourly usage fee per HSM pool | |
|---|---|
| Standard B1 | $- |
Azure pricing and purchasing options
Connect with us directly
Get a walkthrough of Azure pricing. Understand pricing for your cloud solution, learn about cost optimization and request a custom proposal.
Talk to a sales specialistSee ways to purchase
Purchase Azure services through the Azure website, a Microsoft representative, or an Azure partner.
Explore your optionsAdditional resources
Key Vault
Learn more about Key Vault features and capabilities.
Pricing calculator
Estimate your expected monthly costs for using any combination of Azure products.
SLA
Review the Service Level Agreement for Key Vault.
Documentation
Review technical tutorials, videos, and more Key Vault resources.
Frequently asked questions
-
You can store the following types of keys and secrets in Key Vault:
- Keys can be imported or generated in HSMs, and are always locked to the boundary of the HSM. When you ask the Key Vault service to decrypt or sign with a key, the operation is performed inside an HSM.
- You can also encrypt using keys in HSMs. In this case, cryptographic operations are performed in software, as opposed to being inside of an HSM. These computations are performed in Azure compute roles.
- Secrets are data (under 10_KB) such as passwords or .PFX files that your application can store and retrieve in plaintext. The Key Vault service persists secrets encrypted using an HSM-backed key, and provides an access control layer over them.
In addition to keys and secrets, you can also store and manage SSL/TLS certificates that you've purchased from public CAs, and automatically enroll or renew them via Key Vault if the public CA is currently supported by Key Vault.
-
Every successfully authenticated REST API call counts as one operation.
Examples of operations for keys—create, import, get, list, backup, restore, delete, update, sign, verify, wrap, unwrap, encrypt and decrypt. Note that the price charged for an operation may vary based on the type of key (for example, operations performed on a 2,048-bit RSA key vs a 4,096-bit RSA key are billed against different meters with different prices, as described in the pricing section above).
Examples of operations for secrets—create/update, get, list.
Examples of operations for certificates—create, update policy, contacts, import, renewal or update of certificates. Note that a certificate renewal operation has a separate cost from all other operations on certificates.
-
Operations against all keys (software-protected keys and HSM-protected keys), secrets, and certificates are billed at a flat rate of $- per 10,000 operations, except certificate renewal requests, which are billed at a rate of $- per renewal. Examples—A) You perform 2,000 operations with HSM-protected keys, 1,000 operations with software-protected keys, and 500 operations with secrets during a billing cycle. You will be billed for 3,500 operations during that billing cycle. B) In a given billing cycle, you perform 500 operations on 20 certificates, and 2 of these certificates are also renewed by Key Vault. You will be billed for 500 operations and 2 certificate renewal requests.
-
Each key that you generate or import in an Azure Key Vault HSM will be charged as a separate key. You will get charged for a key only if it was used at least once in the previous 30 days (based on the key’s creation anniversary date). Note that if you store multiple (historical) versions of a given key, then each version is treated as a separate key for billing purposes.
Examples:
- You add three HSM protected keys in your key vault. Over the next 30 days, you use the first key 10,000 times, the second key once, and you do not use the third key at all. For this 30-day period, you will get billed for 2 HSM key units. For e.g. if these are 2,048-bit RSA keys, you will get billed 2 x $-/key/month = $-, and if these are 3,072-bit RSA keys, you will get billed 2 x $-/key/month = $-.
- You have 1 HSM protected key in your key vault. You have 5 historical versions of that key because you have changed the value of the key four times. In the last 30 days, you used 2 of those versions, and did not touch the other three. For a 2,048-bit RSA key, you will get billed $- in this example, while for advanced key type, you will get billed $- in this example.
- Note that any operations performed on HSM-protected keys will be charged separately and will apply in addition to the HSM key charges.
-
No, there is no set up fee for Azure Key Vault.
-
HSM key charges are not pro-rated based on length of time it is enabled. We will charge for an HSM key only if it is used at least once in the previous 30 days, based on the key’s creation anniversary date.
-
Yes, you can grant use of keys stored in Key Vault to any app, hosted anywhere (Microsoft Azure, third-party cloud, on-premises).
-
No. Only the key owner gets billed.
Talk to a sales specialist for a walk-through of Azure pricing. Understand pricing for your cloud solution.
Get free cloud services and a $200 credit to explore Azure for 30 days.