Lesson 25 — Microsoft Defender for Key Vault
Azure Key Vault protects some of the most valuable objects in a cloud environment: passwords, connection strings, API keys, encryption keys and certificates.
Microsoft Defender for Key Vault adds Azure-native threat detection by identifying unusual and potentially harmful attempts to access or exploit Key Vault resources.
This lesson follows the complete protection and investigation workflow: vault design, identities, RBAC, network controls, logging, soft delete, purge protection, Defender alerts, evidence review, containment and recovery.
What you will learn
This lesson follows Key Vault security from preventive controls through alert investigation and recovery.
How Microsoft Defender for Key Vault works
↓
Azure Key Vault evaluates identity, permissions and network access
↓
The requested data-plane operation is processed
↓
Defender analyses the activity, context and threat intelligence
↓
Unusual or potentially harmful behaviour generates a security alert
↓
Agent Foskett reviews the identity, source, operation, object and related Azure activity
↓
The affected credentials and access paths are identified
↓
The identity is contained and exposed material is rotated
↓
Vault access, logging and recovery controls are strengthened
↓
Validation confirms the attacker can no longer retrieve or use the protected objects
Key Vault security layers
| Layer | Purpose | Example |
|---|---|---|
| Identity | Control who or what can request vault objects. | Managed identity and Conditional Access. |
| Authorisation | Limit permitted operations. | Least-privilege Azure RBAC. |
| Network | Reduce reachable access paths. | Private endpoint and firewall rules. |
| Threat detection | Identify unusual or harmful activity. | Defender for Key Vault alert. |
| Recovery | Reduce permanent loss from deletion. | Soft delete and purge protection. |
| Investigation | Reconstruct access and response actions. | Diagnostic logs and Activity Log. |
Learning objectives
- Explain Defender for Key Vault.
- Identify the assets protected by Azure Key Vault.
- Understand identity and access models.
- Recognise suspicious vault activity.
- Review Defender alert evidence.
- Contain compromised identities and secrets.
- Use recovery controls to reduce permanent loss.
What is Azure Key Vault?
Azure Key Vault is a cloud service for securely storing and accessing secrets, cryptographic keys and certificates.
What is Defender for Key Vault?
Microsoft Defender for Key Vault is an Azure-native Defender for Cloud plan that detects unusual and potentially harmful attempts to access or exploit Key Vault resources.
Protected objects
- Secrets
- Cryptographic keys
- Certificates
- Vault configuration
- Access activity
- Identity interactions
Secrets
Secrets can include passwords, API keys, connection strings, tokens and other values that applications or administrators must control tightly.
Keys
Cryptographic keys support operations such as encryption, decryption, signing and verification. Their value often extends far beyond the vault itself.
Certificates
Certificates combine public-key material with identity information and are commonly used for TLS, application authentication and signing.
Vaults and Managed HSM
Key Vault supports vaults for keys, secrets and certificates. Managed HSM provides dedicated protection for HSM-backed keys. Confirm plan coverage and design requirements for each service.
Threat detection
Defender analyses access patterns, request context and threat intelligence to identify activity that differs from expected use or appears linked to malicious behaviour.
Unusual access patterns
A sudden increase in secret retrieval, access from an unfamiliar location or a new identity querying sensitive objects can require investigation.
Suspicious IP activity
Access associated with known malicious infrastructure, anonymisation services or unusual network sources can add risk context to otherwise valid operations.
Unfamiliar identity
An identity that has not previously accessed a vault may be legitimate, newly deployed or compromised. Validate its owner, purpose and permissions.
Secret enumeration
Repeated listing or retrieval across many secrets can indicate discovery activity after an identity compromise.
Bulk retrieval
Applications normally request predictable objects. Rapid access to many unrelated secrets, keys or certificates can indicate credential collection.
Access after credential theft
Defender can help identify suspicious use after an attacker obtains a service principal credential, managed identity token or user session.
Azure RBAC
Azure role-based access control can govern access to Key Vault data and management operations. Assign the smallest role at the narrowest practical scope.
Legacy access policies
Some vaults use Key Vault access policies. Avoid granting broad object permissions and review old policies that may outlive their original purpose.
Control plane and data plane
Management actions configure the vault, while data-plane actions access keys, secrets and certificates. Investigations should examine both.
Managed identities
Managed identities reduce the need to distribute static credentials. Their Key Vault permissions still require least privilege and monitoring.
Human administration
Administrative access should use strong authentication, Conditional Access, privileged role management and time-limited elevation wherever possible.
Network security
Restrict vault network access to the applications, networks and services that genuinely require it.
Private endpoints
Private endpoints can provide private connectivity to a vault and reduce exposure to public network paths.
Public network access
Where public access is unnecessary, disable or restrict it. Where it remains required, combine network rules with strong identity controls.
Firewall rules
Key Vault firewall and virtual network rules can limit which network sources are allowed to reach the service.
Logging
Enable diagnostic settings and retain appropriate Key Vault audit events so secret, key, certificate and management activity can be investigated.
Log destinations
Send logs to suitable destinations such as Log Analytics, storage or event streaming based on retention, investigation and integration needs.
Azure Activity Log
Use the Activity Log to review control-plane actions such as vault creation, deletion, networking changes, role assignments and Defender plan changes.
Soft delete
Soft delete allows deleted vaults and vault objects to be recovered during the configured retention period.
Purge protection
Purge protection prevents permanent deletion of soft-deleted vaults and objects until the retention period expires. Once enabled, it cannot simply be disabled.
Deletion protection
Soft delete and purge protection reduce the impact of accidental deletion, compromised administration and destructive insider activity.
Rotation
Rotate secrets, keys and certificates according to risk, lifetime and application requirements. Automate rotation where supported and test dependent applications.
Expiration
Set appropriate expiry dates and monitor approaching expiration so credentials do not remain active indefinitely.
Versioning
Key Vault maintains versions of many objects. Investigators should identify which version was accessed, changed or exposed.
Application design
Applications should retrieve only the objects they require, avoid unnecessary caching and handle rotation without exposing secret values in logs.
Defender alert evidence
- Vault and object type
- Accessing identity
- Source IP and location
- Operation performed
- Time and frequency
- Threat intelligence context
- Related resources
- Recommended response
Initial triage
Confirm the affected vault, identity, operation, source and object type. Determine whether the activity matches a known deployment, rotation process or administrative task.
Identity investigation
Review sign-ins, service principal activity, managed identity usage, role assignments, recent credential changes and every other resource the identity can access.
Object investigation
Identify which secrets, keys or certificates were listed, retrieved, modified, disabled, deleted or purged.
Application investigation
Determine which application normally uses the object and whether its deployment, code, host or identity has been compromised.
Network investigation
Review the source address, expected application network path, private endpoint use, firewall configuration and other activity from the same source.
Scope investigation
Search for the same identity, IP address, operation or time pattern across other vaults and Azure resources.
Containment
- Disable or restrict the compromised identity.
- Remove excessive role assignments.
- Rotate exposed secrets and certificates.
- Rotate or replace affected keys where required.
- Restrict vault networking.
- Block malicious sources.
- Preserve audit evidence.
Application recovery
Update dependent applications with rotated credentials, validate managed identity permissions and confirm that revoked material is no longer accepted.
Validation
Confirm the suspicious access has stopped, applications use the new object versions, network restrictions work and no related activity remains elsewhere.
Agent Foskett investigation: “The application never stored the password…”
↓
No password existed in the source code
↓
Defender for Key Vault raised an alert for unusual secret access
↓
A managed identity had retrieved several unrelated secrets
↓
The requests came from an unexpected workload
↓
Agent Foskett reviewed the identity and role assignments
↓
The identity had inherited access to multiple vaults
↓
A vulnerable application endpoint had been exploited
↓
The attacker used the workload identity to query Key Vault
↓
The database credential was retrieved successfully
↓
The workload was isolated
↓
The identity permissions were removed
↓
The exposed secret was rotated
↓
Other secrets accessed by the identity were also replaced
↓
The application was patched and redeployed
↓
The vault network path was restricted
↓
The application never stored the password
↓
But its identity was allowed to retrieve it
Key Vault investigation checklist
| Area | Question | Evidence |
|---|---|---|
| Vault | Which vault and protected object were involved? | Defender alert and audit events. |
| Identity | Which user, service principal or managed identity made the request? | Object ID, sign-ins and role assignments. |
| Operation | Was the object listed, retrieved, changed, deleted or purged? | Key Vault operation and object version. |
| Source | Where did the request originate? | IP address, network path and related workload. |
| Scope | What other vaults or resources could the identity access? | Azure RBAC, access policies and activity search. |
| Exposure | Which credentials or cryptographic material may be compromised? | Access timeline and application dependencies. |
| Recovery | Were objects rotated, restored or protected from purge? | New versions, recovery settings and validation. |
Key takeaways
- Azure Key Vault stores and controls access to secrets, keys and certificates.
- Defender for Key Vault detects unusual and potentially harmful access attempts.
- Identity compromise can turn legitimate vault permissions into an attack path.
- Azure RBAC and access policies must follow least privilege.
- Private endpoints, firewall rules and public access settings reduce network exposure.
- Diagnostic logs and the Activity Log provide essential investigation evidence.
- Soft delete supports recovery of deleted vaults and objects.
- Purge protection prevents permanent deletion until the retention period expires.
- Exposed secrets, certificates and keys may require rotation or replacement.
- Keeping secrets out of code does not remove the need to secure the identity retrieving them.
What Agent Foskett checked
- Defender alert
- Vault
- Object type
- Object version
- Operation
- Identity
- Role assignments
- Source IP
- Network path
- Application owner
- Other vault access
- Rotation status
Best practices
- Enable Defender protection.
- Use least-privilege RBAC.
- Prefer managed identities.
- Restrict public access.
- Use private endpoints where suitable.
- Enable diagnostic logging.
- Enable purge protection.
- Rotate protected objects.
- Monitor role changes.
- Investigate unusual retrieval promptly.
Related Agent Foskett resources
Continue learning
What is Microsoft Defender for Key Vault?
Microsoft Defender for Key Vault is a Microsoft Defender for Cloud plan that detects unusual and potentially harmful attempts to access or exploit Azure Key Vault resources.
Microsoft Defender for Key Vault Lesson
This Agent Foskett lesson explains Key Vault threat detection, secrets, keys, certificates, managed identities, Azure RBAC, private endpoints, logging, soft delete, purge protection, alert investigation and response.
