Direct answer: at Azure Key Vault public list prices on 10 November 2026 (eastus, USD, excluding tax and discounts), Vault standard operations are $0.03/10K and advanced key operations $0.15/10K; certificate renewals are $3 each and automated key rotation $1 each. Premium HSM-protected keys: RSA 2048 $1/key-month; advanced types (RSA 3072/4096, ECC) are $5/key-month for the first 250, $2.5 for 251–1,500, $0.9 for 1,501–4,000 and $0.4 for 4,001+, with operations billed separately and every active version counted as a separate key. A single-tenant Managed HSM pool is $3.2/hour = $2,336/month (730h), billed per pool, with no per-operation meter listed. Examples: 100 HSM RSA 2048 keys $100/month; 500 advanced keys $1,875; 1,000 $3,125; Managed HSM $2,336, breaking even at about 685 advanced keys; 100M standard operations $300 vs advanced $1,500; 100 certificate renewals $300; 100 keys rotated monthly $100. The most-missed item is versions: 100 keys with 12 active versions each bill as 1,200 advanced keys, $3,625—not $500.
This guide is for teams responsible for keys, certificates and secrets, compliance, OT/IT identity, platform/SRE, finance and procurement. It separates official price facts, editorial calculations and exclusions, covering Standard/Premium, HSM key tiers, the Managed HSM fixed fee, operations/certificates/rotation, version amplification, hidden costs and a 90-day checklist. Prices come from the Key Vault pricing page, Azure Retail Prices API and Microsoft Learn (10 November 2026). This is not procurement advice.
(1) Vault and Managed HSM are different containers: the Premium vault uses multi-tenant HSMs; Managed HSM is a single-tenant pool at a fixed $2,336/month. (2) Operations are cheap; keys, certificates and rotation dominate: 100M standard operations cost $300, but 1,000 advanced HSM keys cost $3,125/month. (3) Every active HSM key version counts as a key: 100 keys × 12 active versions = 1,200 billable keys, $3,625 at advanced rates—not $500.
Two containers: Vault and Managed HSM
Key Vault has two container types: a Vault (Standard/Premium) for keys, secrets, certificates and storage-account keys, and a Managed HSM pool for HSM-backed keys. Standard protects keys in software; Premium uses multi-tenant HSMs; Managed HSM is a single-tenant, FIPS 140-3 Level 3 pool. The cost structures differ: a Vault is "operations + keys/certificates/rotation", while Managed HSM is a fixed pool-hour fee. Most applications need Standard; when HSM compliance appears, compare Premium with Managed HSM before jumping to a dedicated pool.
| Container/tier | Holds | Protection | Pricing |
|---|---|---|---|
| Standard Vault | Keys, secrets, certificates, storage-account keys | Software | Operations + renewals/rotation |
| Premium Vault | Same + HSM-protected keys | Multi-tenant HSM | Operations + HSM key fee + renewals/rotation |
| Managed HSM | HSM-backed keys | Single-tenant HSM pool | Fixed pool-hour fee |
Sources: Key Vault pricing page and Learn "What is Azure Key Vault Managed HSM?" (10 November 2026). Managed HSM is single-tenant and FIPS 140-3 Level 3; Premium is multi-tenant HSM. Regional/feature availability follows the official docs.
Operations: $0.03/10K, advanced keys $0.15/10K
Routine operations on all keys (software or HSM), secrets and certificates are $0.03/10K; the Retail API also lists Advanced Key Operations at $0.15/10K for advanced key types such as RSA 3072/4096 and ECC, with the final classification on the bill. At scale: 1M standard operations $3, 10M $30, 100M $300, 1B $3,000; advanced is 5× ($15/$150/$1,500/$15,000). Certificate renewals are separate at $3 each, not per 10K: 10 renewals $30, 100 $300, 1,000 $3,000.
| Monthly operations | Standard $0.03/10K | Advanced $0.15/10K | Note |
|---|---|---|---|
| 1M | $3 | $15 | Routine API calls |
| 10M | $30 | $150 | Medium app |
| 100M | $300 | $1,500 | High concurrency |
| 1B | $3,000 | $15,000 | Extreme volume |
| 100 certificate renewals | $300 | — | $3 each, separate |
Sources: Key Vault pricing page and Retail API (eastus, 10 November 2026). The mapping of advanced key types to the $0.15 meter follows the official table/bill classification; excludes HSM key fees, rotation, egress and tax.
HSM keys: $1/month plus $5/$2.5/$0.9/$0.4 tiers
Premium HSM-protected RSA 2048 keys are $1/key-month; advanced types (RSA 3072/4096, ECC) use volume tiers: $5 for the first 250, $2.5 for 251–1,500, $0.9 for 1,501–4,000 and $0.4 for 4,001+, plus operations. Only keys used at least once in the prior 30 days bill, and each version bills separately, with no proration. 100 RSA 2048 keys $100/month; 500 advanced $1,875; 1,000 $3,125; 2,000 $4,825; 10,000 $9,025.
| Active keys | Advanced/month | RSA 2048/month | Note |
|---|---|---|---|
| 1 | $5 | $1 | Minimum |
| 100 | $500 | $100 | Small scale |
| 250 | $1,250 | $250 | End of first tier |
| 500 | $1,875 | $500 | Second tier |
| 1,000 | $3,125 | $1,000 | Second tier |
| 2,000 | $4,825 | $2,000 | Third tier |
| 10,000 | $9,025 | $10,000 | Fourth tier |
Editorial calculation: cumulative official tiers, only keys used in the prior 30 days and each active version; excludes operations, Managed HSM, tax and discounts. Whether a version is active determines billing—disable/delete old versions to cut cost.
Managed HSM: $3.2/hour, break-even at about 685 advanced keys
A Managed HSM Standard B1 pool is $3.2/hour, or $2,336 for 730 hours; two pools are $4,672. The page lists only the pool-hour fee, with no per-operation meter. Against Premium keys: 500 advanced keys cost $1,875/month, still below Managed HSM; at about 685 advanced keys the two are close ($2,337.50 vs $2,336); 1,000 advanced keys cost $3,125/month, above Managed HSM. With RSA 2048 keys, the break-even is about 2,336 keys. Managed HSM's premium buys single-tenancy, a dedicated pool and key sovereignty—not just a lower unit price.
| Option | Monthly | Note |
|---|---|---|
| Managed HSM, 1 pool | $2,336 | $3.2 × 730h |
| Managed HSM, 2 pools | $4,672 | HA/multi-region |
| 500 advanced HSM keys | $1,875 | Below one pool |
| 685 advanced HSM keys | $2,337.50 | ≈ one pool |
| 1,000 advanced HSM keys | $3,125 | Above one pool |
| 2,336 RSA 2048 keys | $2,336 | ≈ one pool |
Editorial calculation: Managed HSM $3.2/hour × 730; Premium keys at official tiers; excludes operations, tax and discounts. Break-even is cost equivalence, not compliance/performance/tenancy equivalence.
Certificates and rotation: $3/renewal, $1/rotation, and version amplification
Certificate renewals are $3 each, while other certificate operations use the $0.03/10K meter; automated key rotation is $1 each. 100 renewals cost $300, 1,000 cost $3,000; rotating 100 keys monthly costs $100/month, while daily rotation (about 3,000 rotations) costs $3,000/month. The subtler trap is versions: every active HSM version counts as a key. 100 keys with 12 active versions each = 1,200 billable keys, $3,625 at advanced rates—7.25× the $500 for 100 keys; RSA 2048 goes from $100 to $1,200, 12×. Design rotation together with version cleanup.
| Item | Volume/month | Monthly | Note |
|---|---|---|---|
| Certificate renewals | 10 | $30 | $3 each |
| Certificate renewals | 100 | $300 | $3 each |
| Certificate renewals | 1,000 | $3,000 | $3 each |
| Automated rotation | 10 | $10 | $1 each |
| Automated rotation | 100 | $100 | $1 each |
| Daily rotation, 100 keys | 3,000 | $3,000 | Plus version key fees |
| 100 keys × 12 active versions | 1,200 keys | $3,625 (advanced) | Versions bill separately |
Editorial calculation: $3/renewal, $1/rotation; versions at 100×12; advanced key tiers; excludes operations, tax and discounts. Certificates are issued by public CAs; Key Vault automates enrollment/renewal.
Selection matrix and hidden costs
Match the requirement: software keys/secrets/certificates for normal apps use Standard; HSM compliance with multi-tenancy uses Premium HSM keys; single-tenancy, key sovereignty, a dedicated pool or roughly 685+ advanced keys use Managed HSM; certificate automation should budget $3/renewal; frequent rotation must include both the $1/rotation and version key fees. Seven hidden costs: HSM version amplification, $3 certificate renewals, $1 rotations, the Managed HSM fixed pool-hour fee, private endpoints/Private DNS, diagnostic logs/Log Analytics, and Defender for Key Vault ($0.00034/node-hour, about $0.25/month). 90 days: weeks 1–2 inventory keys/versions/certificates/rotation and compliance requirements; weeks 2–4 price Standard/Premium by operations + keys + certificates + rotation; weeks 4–6 compare the Managed HSM break-even and single-tenancy need; weeks 6–8 clean unused versions and tune rotation; weeks 8–10 test API throttling and private endpoints; weeks 10–12 reconcile key counts, versions and renewals against the bill.
| Scenario | First choice | Check first |
|---|---|---|
| Software keys/secrets/certificates | Standard | Operations, certificate renewals |
| HSM compliance, multi-tenant OK | Premium HSM key | Key count and versions |
| Single-tenant/key sovereignty | Managed HSM | Pool count, region, break-even |
| Heavy certificate automation | Standard/Premium | $3 renewals, CA fees |
| Frequent rotation | Either Vault | $1 rotation + version keys |
| Only a few secrets | Standard | Operations negligible |
Editorial summary, not a vendor recommendation; compliance, regions, throttling and SLA follow the official docs.
FAQ
How is Azure Key Vault billed?
A Vault bills operations at $0.03/10K (advanced keys $0.15/10K), certificate renewals at $3 each and automated rotation at $1 each; Premium HSM keys add a monthly fee (RSA 2048 $1/key, advanced $5/$2.5/$0.9/$0.4 tiers); Managed HSM is $3.2/hour ($2,336/month) per pool.
How much more does Premium cost?
Standard protects keys in software at $0.03/10K operations; Premium adds HSM-protected keys: 100 RSA 2048 keys $100/month, 500 advanced keys $1,875, 1,000 $3,125, plus operations. Without an HSM compliance requirement, Standard is usually enough.
When is Managed HSM worth it?
For single-tenancy, FIPS 140-3 Level 3, key sovereignty/dedicated pools, or when advanced key counts approach/exceed about 685. One pool is $2,336/month; 500 advanced keys at $1,875 are still lower, while 1,000 at $3,125 are higher. Break-even is cost equivalence, not compliance equivalence.
Why do key versions affect the bill?
Every active HSM key version counts as a key, and only versions used in the prior 30 days bill. 100 keys with 12 active versions each = 1,200 keys, $3,625 at advanced rates instead of $500. Disable/delete old versions after rotation or reduce calls to them.
How are certificate renewals billed?
$3 each, separate from other certificate operations ($0.03/10K). 100 renewals cost $300, 1,000 cost $3,000. Key Vault does not issue or resell certificates; it automates enrollment/renewal of public-CA certificates, and CA fees are separate.
Is automated rotation expensive?
$1 per rotation. Rotating 100 keys monthly costs $100/month; daily rotation (about 3,000) costs $3,000/month, plus version key fees. Balance security requirements, the $1 fee and version amplification.
What if operation volume is high?
Standard operations are $0.03/10K: 100M operations $300, 1B $3,000; advanced key operations are $0.15/10K, 5×. First confirm whether HSM/advanced keys are really required, then cache and batch calls to avoid turning high-frequency reads into operation fees.
What other costs are there?
Private endpoints/Private DNS, diagnostic logs/Log Analytics, Defender for Key Vault (about $0.25/node-month), cross-region/egress, and the fixed Managed HSM pool hours. There is no Key Vault setup fee; soft-delete/purge protection adds no charge.
Research method and limitations
Official facts (pricing page, Retail API, Learn): Vault operations $0.03/10K, advanced $0.15/10K, certificate renewals $3, rotation $1; Premium HSM RSA 2048 $1/key-month and advanced $5/$2.5/$0.9/$0.4; only keys used in the prior 30 days bill and each version counts; Managed HSM $3.2/hour, single-tenant, FIPS 140-3 Level 3. Editorial calculations: 730 hours/month, cumulative tiers, the 100×12 version example.
Seven limitations: (1) only eastus public list prices, excluding tax/CSP/enterprise discounts; (2) key/certificate/operation volumes are editorial assumptions; (3) the mapping of advanced key types to the $0.15 meter follows the bill classification; (4) excludes CA certificate fees, private endpoints/DNS, logs, Defender, egress and tax; (5) no throttling, latency or failover benchmark; (6) Managed HSM regional/pool sizes and quotas are not checked one by one; (7) prices and roadmaps change—recheck official pages and bills before purchase.
Sources and basis
- Microsoft Azure, Azure Key Vault Pricing: azure.microsoft.com/en-us/pricing/details/key-vault. Standard/Premium, operations, HSM keys, certificate renewals, rotation, Managed HSM. Accessed 10 November 2026.
- Azure Retail Prices API (productName=Key Vault, eastus): prices.azure.com/api/retail/prices. $0.03/$0.15, $1/$5/$2.5/$0.9/$0.4, $3/$1, $3.2/hour. Accessed 10 November 2026.
- Microsoft Learn, What is Azure Key Vault Managed HSM: key-vault/managed-hsm/overview. Single-tenancy, FIPS 140-3 Level 3, pool pricing. Accessed 10 November 2026.
- Microsoft Learn, Azure Key Vault overview: key-vault/general/overview. Vault vs Managed HSM, Standard/Premium, keys/secrets/certificates. Accessed 10 November 2026.
Data cut-off 10 November 2026; prices/availability follow Microsoft official pages and bills; this is not procurement, commercial or legal advice.