agentsclimarketplace

Azure key vault

Skill MicrosoftDocs/Agent-Skills/skills/azure-key-vault

Curated Agent Skills for Microsoft & Azure – giving AI coding assistants structured, real-time expertise from Microsoft Learn docs.

Install
npx -y skills add MicrosoftDocs/Agent-Skills --skill azure-key-vault

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Expert knowledge for Azure Key Vault development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when managing Key Vault secrets/keys, Managed HSM, Private Link, Event Grid, or key rotation/BYOK workflows, and other Azure Key Vault related development tasks. Not for Azure Dedicated HSM (use azure-dedicated-hsm), Azure Cloud Hsm (use azure-cloud-hsm), Azure Payment Hsm (use azure-payment-hsm), Azure Information Protection (use azure-information-protection).

SKILL.md

18.9 KB, as published. Nobody here has run it

Azure Key Vault Skill

This skill provides expert guidance for Azure Key Vault. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

  • Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
  • Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

CategoryLinesDescription
TroubleshootingL37-L46Diagnosing and fixing Key Vault errors: REST/API error codes, Private Link and access policy issues, Azure Policy enforcement, and Managed HSM external key management problems.
Best PracticesL47-L53Best practices for securing Key Vault keys, handling Managed HSM disaster recovery, and generating/importing BYOK HSM keys for compliant, resilient key management.
Decision MakingL54-L64Guidance on planning and migrating key workloads, choosing RBAC vs access policies, using and retiring Managed HSM external keys, SLA/responsibility tradeoffs, and capacity/scaling decisions.
Architecture & Design PatternsL65-L70Architecture and workflows for using external key stores with Managed HSM, including key lifecycle management, integration patterns, and operational considerations.
Limits & QuotasL71-L82Limits, quotas, and behaviors for Key Vault and Managed HSM (certificates, secrets, throttling, logging latency, IP firewall/network rules, soft-delete/recovery, and capacity constraints).
SecurityL83-L113Securing Azure Key Vault and Managed HSM: access control (RBAC/ABAC/policies), networking/firewalls/private endpoints, Zero Trust, soft delete, HSM key transfer, and backup/restore.
ConfigurationL114-L138Configuring Key Vault and Managed HSM: monitoring, alerts, logging, policies, key/secret types, BYOK, key/secret rotation, secure key release, replication, and governance.
Integrations & Coding PatternsL139-L169Patterns for integrating Key Vault with apps and services (Event Grid, Logic Apps, Private Link, Databricks, DigiCert) and using keys/secrets from .NET, Node.js, Python, JavaScript, and Managed HSM.
DeploymentL170-L173How to deploy and provision Azure Key Vault and Managed HSM (vaults, keys, secrets) using ARM templates, Bicep, Terraform, Azure CLI, and PowerShell

Troubleshooting

TopicURL
Resolve common Azure Key Vault error codeshttps://learn.microsoft.com/en-us/azure/key-vault/general/common-error-codes
Diagnose and fix Azure Key Vault Private Link configuration issueshttps://learn.microsoft.com/en-us/azure/key-vault/general/private-link-diagnostics
Interpret Azure Key Vault REST API error codeshttps://learn.microsoft.com/en-us/azure/key-vault/general/rest-error-codes
Troubleshoot Azure Policy enforcement on Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/troubleshoot-azure-policy-for-key-vault
Troubleshoot Azure Key Vault access policy failureshttps://learn.microsoft.com/en-us/azure/key-vault/general/troubleshooting-access-issues
Troubleshoot Managed HSM external key management issueshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-troubleshooting

Best Practices

TopicURL
Apply security best practices for Azure Key Vault keyshttps://learn.microsoft.com/en-us/azure/key-vault/keys/secure-keys
Execute disaster recovery for Azure Managed HSM disruptionshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/disaster-recovery-guide
Generate and import BYOK HSM keys into Azure Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/hsm-protected-keys-byok

Decision Making

TopicURL
Plan and execute migration of cryptographic key workloadshttps://learn.microsoft.com/en-us/azure/key-vault/general/migrate-key-workloads
Migrate Azure Key Vault from access policies to RBAChttps://learn.microsoft.com/en-us/azure/key-vault/general/rbac-migration
Answer common questions on Managed HSM external keyshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-faq
Migrate workloads off Managed HSM external keyshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-migration
Decide when to use Managed HSM external key managementhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-overview
Evaluate SLA and responsibilities for Managed HSM external keyshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-shared-responsibility
Plan capacity and scaling for Azure Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/scaling-guidance

Architecture & Design Patterns

TopicURL
Understand Managed HSM external key management architecturehttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-architecture
Manage external key lifecycle in Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-key-lifecycle

Limits & Quotas

TopicURL
Understand Azure Key Vault certificate limits and behaviorshttps://learn.microsoft.com/en-us/azure/key-vault/certificates/faq
Configure and interpret Azure Key Vault logging latencyhttps://learn.microsoft.com/en-us/azure/key-vault/general/logging
Understand and manage Azure Key Vault throttling limitshttps://learn.microsoft.com/en-us/azure/key-vault/general/overview-throttling
Review Azure Key Vault and Managed HSM service limitshttps://learn.microsoft.com/en-us/azure/key-vault/general/service-limits
Configure Managed HSM IP firewall and network securityhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/configure-network-security
Review Azure Managed HSM service limits and quotashttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/service-limits
Use soft-delete and recovery for Managed HSM resourceshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/soft-delete-overview
Understand Azure Key Vault secret size limitshttps://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets

Security

TopicURL
Apply security best practices to Key Vault certificateshttps://learn.microsoft.com/en-us/azure/key-vault/certificates/secure-certificates
Allow Azure Key Vault access from clients behind firewallshttps://learn.microsoft.com/en-us/azure/key-vault/general/access-behind-firewall
Prepare for Azure Key Vault RBAC default and API retirementhttps://learn.microsoft.com/en-us/azure/key-vault/general/access-control-default
Configure Azure Key Vault access policies with CLIhttps://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy
Configure authentication to Azure Key Vault with Entra IDhttps://learn.microsoft.com/en-us/azure/key-vault/general/authentication
Add Azure ABAC conditions for Key Vault via CLIhttps://learn.microsoft.com/en-us/azure/key-vault/general/howto-abac-conditions-cli
Add Azure ABAC conditions for Key Vault via PowerShellhttps://learn.microsoft.com/en-us/azure/key-vault/general/howto-abac-conditions-powershell
Configure network security options for Azure Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/network-security
Restrict Azure Key Vault access with VNet service endpointshttps://learn.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints
Use Azure ABAC actions and attributes for Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/rbac-abac
Choose Azure RBAC vs access policies for Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy
Configure Azure RBAC access for Azure Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide
Apply Zero Trust security practices to Azure Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/secure-key-vault
Configure and use Azure Key Vault soft-delete safelyhttps://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview
Generate and transfer HSM-protected keys to Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/keys/hsm-protected-keys
Implement BYOK HSM key transfer for Azure Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/keys/hsm-protected-keys-byok
Configure access control for Azure Key Vault Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/access-control
Configure ARM access for Managed HSM key managementhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/authorize-azure-resource-manager
Perform full and selective backup/restore for Azure Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/backup-restore
Use Managed HSM built-in local RBAC roleshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/built-in-roles
Configure networking and mTLS for Managed HSM external keyshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-networking
Implement secure access control for Azure Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/how-to-secure-access
Configure network security and firewall for Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/network-security
Configure Managed HSM private endpoints with Private Linkhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/private-link
Manage data plane RBAC roles for Azure Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/role-management
Apply security best practices to Managed HSM deploymentshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/secure-managed-hsm
Apply security best practices for Key Vault secretshttps://learn.microsoft.com/en-us/azure/key-vault/secrets/secure-secrets

Configuration

TopicURL
Configure health and throttling alerts for Azure Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/alert
Formulate authenticated JSON requests to Azure Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/authentication-requests-and-responses
Apply Azure Policy to govern Azure Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/azure-policy
Enable and configure Azure Key Vault diagnostic logginghttps://learn.microsoft.com/en-us/azure/key-vault/general/howto-logging
Configure monitoring for Azure Key Vault with Azure Monitorhttps://learn.microsoft.com/en-us/azure/key-vault/general/monitor-key-vault
Reference monitoring metrics and logs for Azure Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/monitor-key-vault-reference
Configure Azure Key Vault key types and algorithmshttps://learn.microsoft.com/en-us/azure/key-vault/keys/about-keys-details
Follow BYOK specification for importing HSM keys to Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/keys/byok-specification
Configure automatic cryptographic key rotation in Azure Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation
Author secure key release policies in Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/keys/policy-grammar
Configure key types and algorithms in Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/about-keys-details
Configure health and performance alerts for Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/configure-alerts
Configure logging and monitoring for Managed HSM external keyshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-logging-monitoring
Configure automated key rotation in Azure Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/key-rotation
Configure logging and audit events for Azure Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/logging
Configure multi-region replication for Azure Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/multi-region-replication
Author secure key release policies for Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/policy-grammar
Configure soft-delete and purge protection for Managed HSMhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/recovery
Configure Azure Key Vault to store multiline secretshttps://learn.microsoft.com/en-us/azure/key-vault/secrets/multiline-secrets
Automate single-credential secret rotation in Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/secrets/tutorial-rotation
Configure dual-credential secret rotation in Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/secrets/tutorial-rotation-dual

Integrations & Coding Patterns

TopicURL
Integrate Azure Key Vault with DigiCert CAhttps://learn.microsoft.com/en-us/azure/key-vault/certificates/how-to-integrate-certificate-authority
Trigger Logic Apps from Key Vault events via Event Gridhttps://learn.microsoft.com/en-us/azure/key-vault/general/event-grid-logicapps
Integrate Azure Key Vault events with Azure Event Gridhttps://learn.microsoft.com/en-us/azure/key-vault/general/event-grid-overview
Handle Azure Key Vault notifications with Event Grid and Automationhttps://learn.microsoft.com/en-us/azure/key-vault/general/event-grid-tutorial
Access Blob Storage via Databricks using Key Vault secretshttps://learn.microsoft.com/en-us/azure/key-vault/general/integrate-databricks-blob-storage
Integrate Azure Key Vault with Azure Private Linkhttps://learn.microsoft.com/en-us/azure/key-vault/general/private-link-service
Use Node.js on VMs to read secrets from Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/tutorial-javascript-virtual-machine
Connect ASP.NET Core web apps to Azure Key Vaulthttps://learn.microsoft.com/en-us/azure/key-vault/general/tutorial-net-create-vault-azure-web-app
Integrate .NET VM apps with Azure Key Vault secretshttps://learn.microsoft.com/en-us/azure/key-vault/general/tutorial-net-virtual-machine
Access Azure Key Vault from Python on virtual machineshttps://learn.microsoft.com/en-us/azure/key-vault/general/tutorial-python-virtual-machine
Back up, delete, and restore keys in JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-backup-delete-restore-key
Create and rotate Key Vault keys in JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-create-update-rotate-key
Enable or disable Key Vault keys in JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-enable-disable-key
Encrypt and decrypt with Key Vault keys in JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-encrypt-decrypt-key
Retrieve Azure Key Vault keys in JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-get-key
Import keys into Azure Key Vault with JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-import-key
List Azure Key Vault keys using JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-list-key-version
Sign and verify with Key Vault keys in JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-sign-verify-key
Implement EKM Proxy API for Managed HSM external keyshttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-proxy-api-reference
Create external keys with Managed HSM using Azure CLIhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-quickstart-cli
Create external keys with Managed HSM in Azure portalhttps://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-quickstart-portal
Back up and restore Key Vault secrets in JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-backup-secrets
Delete and purge Key Vault secrets with JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-delete-secret
Enable or disable Key Vault secrets using JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-enable-disable-secret
Retrieve Azure Key Vault secrets with JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-get-secret
Use Azure Key Vault secrets from JavaScript applicationshttps://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-get-started
Create, update, and rotate Key Vault secrets with JavaScripthttps://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-set-update-rotate-secret

Deployment

TopicURL
Provision Key Vault and key using Terraformhttps://learn.microsoft.com/en-us/azure/key-vault/keys/quick-create-terraform

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.