# Azure Key Vault

> Chapter 99 of the Courseiva AZ-900 curriculum — https://courseiva.com/learn/az-900/azure-key-vault

**Official objective:** 2.5 — Azure Architecture Services

## Introduction

This chapter covers Azure Key Vault for storing secrets. AZ-900 tests under 2.5.

## A Vault for Secrets

A physical vault keeps valuables secure. Azure Key Vault keeps digital secrets (passwords, API keys, certificates) secure and accessible only to authorized applications.

## Core explanation

Key Vault stores secrets, keys, and certificates, controlling access and enabling secure retrieval by applications. It's the place to store sensitive information instead of hardcoding it in applications.

## Real-world context

An application retrieves its database password from Key Vault at runtime instead of storing it in code, improving security.

## Exam focus

Objective 2.5 expects understanding of Key Vault as a secrets storage solution.

## Step by step

1. **Create a Key Vault** — A vault is created in an Azure region.
2. **Store secrets** — API keys, passwords, certificates are stored in the vault.
3. **Grant access** — Applications are granted permission to retrieve specific secrets.
4. **Applications use secrets** — Apps retrieve secrets from the vault as needed, not from code.

## Key takeaways

- Key Vault stores secrets securely.
- Controls access to sensitive information.
- Applications retrieve secrets at runtime, not from code.

## FAQ

**What is Azure Key Vault?**

It's a service for storing secrets, keys, and certificates securely, controlling access and enabling secure retrieval by applications.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/az-900/azure-key-vault