Secrets Management · pricing · Updated September 2026
Azure Key Vault pricing (2026)
Azure Key Vault publishes no monthly price — its published figure is on another basis (annual-only, non-USD, or one-time) as checked on 2026-09-05, read from Azure Key Vault's own pricing page; 2 plans. Best for Azure-native workloads requiring HSM-protected keys without on-prem HSM hardware. Every figure below links to its source and the date we captured it.
At a glance
- Entry price: not priced monthly
- Free tier: No
- Compliance: HIPAA Yes · SOC 2 Yes · GDPR Yes
- Best for: Azure-native workloads requiring HSM-protected keys without on-prem HSM hardware; HIPAA-regulated applications already on Microsoft Azure; Enterprises requiring deep integration with Azure AD, AKS, and Azure DevOps
As of · every figure below links to its source
Azure Key Vault plans & pricing
| Plan | Monthly | Annual | Billing | Notes | Source |
|---|---|---|---|---|---|
| Standard Tier — Secrets Operations | not priced monthly | — | custom | $0.03 per 10,000 secrets operations. $0.03 per 10,000 certificate operations. $3.00 per certificate renewal request. No setup fees. No flat monthly tier. | azure.microsoft.com |
| Premium Tier — HSM-Protected Keys | not priced monthly | — | custom | RSA 2048-bit HSM key: $1.00/key/month + $0.03/10,000 transactions. RSA 3072/4096-bit and ECC keys: $5.00/key/month (first 250 keys) + $0.03/10,000 transactions. Managed Storage Account Key Rotation: $1.00/renewal. HSM charges not prorated. | azure.microsoft.com |
Last verified 2026-09-05. Official pricing page azure.microsoft.com/en-us/pricing/details/key-vault/ timed out on first attempt. Pricing sourced from Infisical's Azure Key Vault Pricing guide (infisical.com/blog/azure-key-vault-pricing) which cites official Microsoft pricing. No explicit HIPAA/BAA statement found in fetched content; Azure generally supports HIPAA via Microsoft Online Services BAA but not confirmed in this specific fetch. No flat tiers — pure per-operation and per-key metered pricing. Re-verified 2026-09-03 against the live pricing page; published figures unchanged.
Price changes
No change record has cleared two sources yet, so nothing is published on the wire.
Capabilities
Integrations: Azure Active Directory / Entra ID (identity-based access), Azure Kubernetes Service (CSI Secrets Store Driver), Azure App Service (managed identity reference), Azure DevOps Pipelines, Azure Resource Manager / Bicep, Terraform (azurerm provider), GitHub Actions, Microsoft Defender for Key Vault.
Key features: HSM-backed key storage (FIPS 140-2 Level 2 Standard; Level 3 Premium) without managing HSM hardware; Managed HSM offering for dedicated single-tenant HSM pools; Soft-delete and purge protection for accidental deletion recovery; Automated certificate lifecycle management with DigiCert and GlobalSign integration; Azure Private Link support for network-isolated vault access.
Plan limits: Standard: $0.03 per 10,000 secrets operations; no per-secret monthly fee; Premium: $1.00/key/month for RSA-2048 HSM keys; $5.00/key/month for RSA-3072/4096 and ECC; No free tier; Azure free account includes limited credits but no permanent Key Vault free allocation; No throttling tier — pay-per-operation only.
Frequently asked questions
Does Azure Key Vault support HIPAA?
Azure Key Vault HIPAA support: Yes. SOC 2: Yes. GDPR: Yes.
Does Azure Key Vault have a free plan?
Azure Key Vault free tier: No.
Azure Key Vault vs alternatives
Compare all secrets management · True cost of secrets management · SOC 2-certified secrets management · HIPAA-compliant secrets management · GDPR-compliant secrets management · Open data · MCP
More secrets management tools
Related categories
Display this standing
Azure Key Vault currently holds a bronze deskmark here — Rank 6 of 8 · Secrets Management. Anyone may show it. There is nothing to apply for, nothing to pay, and displaying it changes no score: the standing comes from the published algorithm and money never touches it.
The image is drawn from our live data, so it follows the standing rather than freezing it: if Azure Key Vault moves up or down a tier, the plaque on your own site says so at our next publish. Nothing is tracked beyond the ordinary web-server log that records any image request.