Centralized Management and Rotation of Azure Access Keys via Key Vault

Hello, @Sridevi Machavarapu
Thank you for the detailed response. I have a few follow-up questions to clarify the key management behavior in Azure:

1. Regarding automatic key rotation for Azure Storage Accounts — as far as I understand, the feature seems to be deprecated/legacy and no longer supported. Is this correct?
2. Even if a resource key is stored in Azure Key Vault, the key value can still be retrieved through the portal or CLI as long as the caller has the appropriate permissions. In that case, how is “secure storage” actually guaranteed? I would like to understand what the real security benefit is when the key remains fully retrievable.
3. For Azure AI Search and Azure OpenAI, are the keys essentially API keys used only for HTTP invocation, without any relation to SAS or access-level keys? Just confirming whether they behave simply as API authentication tokens.

Thank you again for your support.

Hello Yu-Jeong Seo,

Thank you for the follow-up questions. Please find the clarifications below.

1. Azure Storage account key rotation Storage account key rotation is not deprecated. Storage still provides two access keys and supports regenerating them. What is not available is a fully built-in, hands-off auto-rotation feature. In practice, auto-rotation is implemented using Key Vault together with Logic Apps, Azure Functions, or Automation to rotate keys on a schedule. For new designs, Microsoft generally recommends using Microsoft Entra ID and managed identities instead of Storage access keys where possible.

2. Security value of Key Vault when keys are still retrievable Key Vault does not prevent authorized users from retrieving secrets. Its main security benefit is central control and auditing:

• Keys are not stored in code or configuration files.
• Access is controlled using Entra ID and Key Vault roles.
• All access is logged and auditable.
• Secrets are encrypted and protected with soft delete and purge protection.

This helps reduce accidental exposure and improves governance and visibility.

3. Azure AI Search and Azure OpenAI keys Yes, these keys work as API keys:

• They are sent in an HTTP header when calling the API.
• They are used only to authenticate requests to those services.
• They are not SAS tokens and not equivalent to Storage access keys.

Hello Yu-Jeong Seo,

Just checking in to see if the above provided information helped you in any way or not. Please upvote the comment if it helped and feel to reach out for any further queries!

Hello, @Sridevi Machavarapu

We can use features like advanced notifications for access key rotation. However, API keys do not provide such capabilities, so we are considering using API Management (APIM).

With APIM, is it possible to implement rotation notifications for those API keys, or log where specific API keys are being used?

Hello Yu-Jeong Seo,

Yes, API Management (APIM) can help, but with some limitations.

Rotation notifications: APIM does not have a built-in feature for automatic rotation alerts. However, you can implement this using Logic Apps, Azure Functions, or Automation with the APIM management API. That automation can rotate the subscription key on a schedule and send email or Teams notifications.

Logging where a specific API key is used: Yes, this is supported. When diagnostics are enabled, APIM logs each request with the subscription key context. In Application Insights or Log Analytics, you can see which API was called, when it was called, and from which IP for a given key.

Scope note: APIM manages only its own subscription keys. Backend service keys (for example, Azure OpenAI or Cognitive Services) still need to be stored in Key Vault and rotated separately.