Secrets Management · pricing · Updated September 2026
Azure Key Vault pricing (2026)
Azure Key Vault publishes no monthly price — its published figure is on another basis (annual-only, non-USD, or one-time) as checked on 2026-09-05, read from Azure Key Vault's own pricing page; 2 plans. Best for Azure-native workloads requiring HSM-protected keys without on-prem HSM hardware. Every figure below links to its source and the date we captured it.
At a glance
- Entry price: not priced monthly
- Free tier: No
- Compliance: HIPAA Yes · SOC 2 Yes · GDPR Yes
- Best for: Azure-native workloads requiring HSM-protected keys without on-prem HSM hardware; HIPAA-regulated applications already on Microsoft Azure; Enterprises requiring deep integration with Azure AD, AKS, and Azure DevOps
As of · every figure below links to its source STALE · 2026-09-05
Azure Key Vault plans & pricing
| Plan | Monthly | Annual | Billing | Notes | Source |
|---|---|---|---|---|---|
| Standard Tier — Secrets Operations STALE · 2026-09-05 | not priced monthly | — | Custom / quote | $0.03 per 10,000 secrets operations. $0.03 per 10,000 certificate operations. $3.00 per certificate renewal request. No setup fees. No flat monthly tier. | azure.microsoft.com |
| Premium Tier — HSM-Protected Keys STALE · 2026-09-05 | not priced monthly | — | Custom / quote | RSA 2048-bit HSM key: $1.00/key/month + $0.03/10,000 transactions. RSA 3072/4096-bit and ECC keys: $5.00/key/month (first 250 keys) + $0.03/10,000 transactions. Managed Storage Account Key Rotation: $1.00/renewal. HSM charges not prorated. | azure.microsoft.com |
Last verified 2026-09-05. STALE marks a plan we have not re-checked at its source in over 30 days. Every plan above is marked — we flag rather than silently retain. Official pricing page azure.microsoft.com/en-us/pricing/details/key-vault/ timed out on first attempt. Pricing sourced from Infisical's Azure Key Vault Pricing guide (infisical.com/blog/azure-key-vault-pricing) which cites official Microsoft pricing. No explicit HIPAA/BAA statement found in fetched content; Azure generally supports HIPAA via Microsoft Online Services BAA but not confirmed in this specific fetch. No flat tiers — pure per-operation and per-key metered pricing.
Price changes
No change record has cleared two sources yet, so nothing is published on the wire.
Capabilities
Integrations: Azure Active Directory / Entra ID (identity-based access), Azure Kubernetes Service (CSI Secrets Store Driver), Azure App Service (managed identity reference), Azure DevOps Pipelines, Azure Resource Manager / Bicep, Terraform (azurerm provider), GitHub Actions, Microsoft Defender for Key Vault.
Key features: HSM-backed key storage (FIPS 140-2 Level 2 Standard; Level 3 Premium) without managing HSM hardware; Managed HSM offering for dedicated single-tenant HSM pools; Soft-delete and purge protection for accidental deletion recovery; Automated certificate lifecycle management with DigiCert and GlobalSign integration; Azure Private Link support for network-isolated vault access.
Plan limits: Standard: $0.03 per 10,000 secrets operations; no per-secret monthly fee; Premium: $1.00/key/month for RSA-2048 HSM keys; $5.00/key/month for RSA-3072/4096 and ECC; No free tier; Azure free account includes limited credits but no permanent Key Vault free allocation; No throttling tier — pay-per-operation only.
Frequently asked questions
Does Azure Key Vault support HIPAA?
Yes — Azure Key Vault states HIPAA support on its public pages. Its public pages also state SOC 2 and GDPR compliance.
Does Azure Key Vault have a free plan?
No — Azure Key Vault publishes no free tier.
Azure Key Vault vs alternatives
Compare all secrets management · True cost of secrets management · SOC 2 claims in secrets management · HIPAA claims in secrets management · GDPR claims in secrets management · Open data · MCP
More secrets management tools
Related categories
This standing as a plaque
Azure Key Vault currently holds a bronze deskmark here — Rank 6 of 8 · Secrets Management. Anyone may show it. There is nothing to apply for, nothing to pay, and displaying it changes no score: the standing comes from the published algorithm, which never reads commission data. We never ask anyone to show it, and its link carries rel="nofollow".
The image is drawn from our live data, so it follows the standing rather than freezing it: if Azure Key Vault moves up or down a tier, the plaque on your own site says so at our next publish. Nothing is tracked beyond the ordinary web-server log that records any image request.