Azure Key Vault: RBAC vs access policies, soft delete and purge protection, key rotation, network restrictions, Defender for Key Vault

Azure Key Vault is a managed service for storing secrets (passwords, connection strings), cryptographic keys (RSA and EC keys used for encryption and signing) and certificates. Applications fetch what they need at runtime using their Entra identity, so secrets stay out of code. The Premium tier adds keys protected by hardware security modules (HSMs); Azure Key Vault Managed HSM is a separate single-tenant offering for stricter requirements.