Key points

• Key Vault protects secrets, keys, and certificates behind authenticated and authorized operations.
• Vault administration, secret retrieval, and cryptographic use should be separated and accessed through workload identities.

Best-known use cases

• Centralize certificate and secret rotation while applications retrieve or use protected material through managed identity.

What candidates often confuse it with

• Key Vault holds protected material; App Configuration stores non-secret settings and feature flags.

Key takeaway

Use Key Vault when applications need controlled secret, key, or certificate custody without exporting key material unnecessarily.

Relevant exam tasks

• D1.2.S5 — Recommend a solution to manage secrets, certificates, and keys
• D4.2.S5 — Recommend an application configuration management solution

Learn more

• Azure Key Vault overview