Azure Key Vault
We are listening! Please take a few moments to submit your ideas or up-vote already submitted ideas by others. Azure Key Vault team regularly monitors and reviews all feedback submitted on this forum. You will be one of the first to know when a requested feature will be worked on! So be sure to vote or submit your ideas! Remember this site is for feature suggestions and ideas. For technical questions please try documentation, MSDN Forum or StackOverFlow
-
1 vote
-
Add an extra transparent layer of redundancy for AKV.
Each AKV is has redundancy as a region pair. ie, West and North Europe. If both these regions are down then any applications using this are down. My case is SQL server TDE.
Add a way to copy the keys and secret to another/multiple Region pair (already exists) but with a load balancer/failover group above.
Therefore SQL will reference the failover group, which will route the request to what ever vault is working.1 vote -
default
The default region for hosting a resource should be defaulted from the resource group, currently we have a azure subscription in southeastasia and when creating a new resource the default region is "East-US", this could inadvertently lead to errors. Ideally the resource's region should default from the resource group
1 vote -
Add a createMode: recoverIfDeleted
The soft delete feature is becoming troublesome for some automation scenarios. I'm managing my environments via Bicep/ARM templates and Key Vaults are a common component within each environment. Some environments are spun up frequently and torn down quickly after and sometimes these are just infrastructure unit tests in my pipelines.
The issue arises if any key vault has softdelete turned on because any subsequent deployments will fail unless I specify 'recover' createMode but that will cause the first deployment to fail because the key vault had not been deleted.
This breaks the idempotency of my deployments as I want to…
1 vote -
Subscription based role inheritance control option should be there for Keyvaults
As of today, all the access roles applicable for Subscription get applied to Resource Group and Key Vault level. What if i don't want at any cost to have my secrets stored in Azure Key Vault to be revealed to anyone else in group
1 vote -
List of secrets can be larger than 9 entries
In azure portal, the list of secrets is by default capped to 9 entries. If you want to see more, you can press 'Load more'.
There is room for much more than 9, so it would be good to make it the same as other lists in the azure portal are working1 vote -
Support key derivation function for ECDH
Add the possibility to use EC keys also for key derivation like in this example: https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.ecdiffiehellmancng?view=dotnet-plat-ext-5.0#examples
It seems that other Cloud HSM are able to do this: https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-mechanisms.html#pkcs11-mech-annotations-5
1 vote -
Hi, Subscription name should be coped to log analytic so can easily can answer with name for any query
Log analytic
1 vote -
Setting minimum TLS version
KeyVaults should let users determine the minimum TLS version to use. This is inline with many other azure services (ex. Web Apps, Functions, SQL), increases security and is more future proof (TLS 1.0 and 1.1 is quite old).
6 votes -
Within documentation or in the product overview pages include a list of other Azure services that are dependencies for Key Vault
When large organizations adopt cloud services they may evaluate the cloud service in depth, along with all other cloud services that must or may be adopted as dependencies of the primary service being planned for use. An example is that when adopting Azure Key Vault a customer will be required to adopt Azure Active Directory if not already adopted, and therefore adopting Key Vault will necessitate an in-depth security assessment of Azure AD in addition to Key Vault.
Currently Microsoft does not list dependencies of any kind on the product web pages of all the many Azure services. This obliges…
1 vote -
Key Vault performance issue breaks Azure Functions
When retrieving the Azure Functions host key, the service sometimes returns a GatewayTimeout error.
The Azure Web App support team analyzed the issue and identified a Key Vault performance issue as the root cause.
"More specific, the related KeyVault API call took longer than expected. As a result of this issue, the related function site failed to be started properly so “ListKey” threw out “Timeout” exception [...]"
Please vote for implementing "Key Vault Reference Perf Improvements".
6 votes -
HMAC signing
As an application developer, I have had a number of situations where HMAC signing has been a key part of application security, such as:
- Signing “local” session tokens (JWT, cookies, etc)
- Third-party integrations (API authentication)
- Integrity of data at rest
In many of these scenarios, ECC signing is either too heavy or not possible due to third-party dependencies. For scenarios where the same Key Vault can do the signing and verification, it would be ideal for us to be able to either generate or import a symmetric key in Key Vault for use with HMAC.
This would allow us to…
1 vote -
Remove option to toggle IP config from dynamic to static
As per documentation: "When creating a private endpoint, a read-only network interface is also created for the lifecycle of the resource. The interface is assigned dynamically private IP addresses from the subnet that maps to the private link resource. The value of the private IP address remains unchanged for the entire lifecycle of the private endpoint."
However now the system lets you go into the NIC, go into the IP cofig and toggle the IP settings from dynamic to static. This is not allowed by the system and results in an error when saving. Please remove this option from here…1 vote -
Multi-Region Key Vault
Currently, Key Vault only supports one single region via collocation constraint, but there are usecases which having a multi-region Key Vault is necessary such as Encryption Scope.
What I am suggesting is to implement a version of Key Vault which supports multiple regions instead of just one
2 votes -
Is there a way to programatically create a key vault?
I need to be able to programmatically create a key vault in code. c#. But I don't see any documentation that will allow me to do that except for az.
1 vote -
On Prem AKV
Even with premium, AKV is placed in the Microsoft Datacenters. That is the main reason customers don't want to have both data and keys on the same cloud or with the provider, which is Microsoft.
This is a much bigger problem in the EU.Why can't Microsoft create AKV as a device which customers can buy and put in their own data center? Add it as a registered device in Azure subscription, and then it provides the same interface and API.
2 votes -
Configure key vault managed storage accounts via ARM template
This link describes configuring Key Vault managed storage accounts with PowerShell.
https://docs.microsoft.com/en-us/azure/key-vault/secrets/overview-storage-keys-powershellIf we could do the same in an ARM template, it would reduce deployment complexity and allow us to leverage the functionality in air-gapped environments.
20 votes -
Offer Logic App as a choice in the Event Endpoint dropdown
When you are creating a new Event Subscription you should be able to choose Logic App as a possible option for the Event Handler / Endpoint Type.
3 votes -
Enable compound identity access using az cli
Per https://github.com/MicrosoftDocs/azure-docs/issues/49362 - currently az cli does not allow setting compond identity access to a keyvault.
3 votes -
Allow "Microsoft.KeyVault/vaults/accessPolicies/write" permission to work without having to also assign "Microsoft.KeyVault/vaults/write"
At present "Microsoft.KeyVault/vaults/accessPolicies/write" is insufficient to block or enable user for modifying the access policy of the key vault.
To block or enable access policy you have to add "Microsoft.KeyVault/vaults/write" as well. This means that we cannot properly apply least privilege to users who we just want to block or allow to modify access policies only.
3 votes
- Don't see your idea?