HashiCorp Vault to Azure Key Vault Migration Center¶

The definitive resource for migrating from HashiCorp Vault (OSS and Enterprise) to Azure Key Vault, with CSA-in-a-Box as the secrets management and governance integration layer.

Who this is for¶

This migration center serves platform engineers, security architects, DevOps engineers, CISOs, and federal security teams who are evaluating or executing a migration from HashiCorp Vault to Azure Key Vault. Whether you are responding to IBM acquisition uncertainty, BSL license concerns, infrastructure overhead reduction mandates, or a strategic consolidation around Azure-native services, these resources provide the evidence, patterns, and step-by-step guidance to execute confidently.

Quick-start decision matrix¶

How CSA-in-a-Box fits¶

CSA-in-a-Box is not a secrets management tool. Azure Key Vault is the secrets management service. CSA-in-a-Box is the analytics and governance landing zone where Azure Key Vault serves as the central secrets management layer that secures every CSA-in-a-Box component.

flowchart TD
    subgraph AKV["Azure Key Vault"]
        SEC[Secrets]
        KEY[Keys - HSM-backed]
        CRT[Certificates]
        ROT[Rotation Policies]
    end

    subgraph MI["Managed Identity Layer"]
        SYS[System-Assigned MI]
        USR[User-Assigned MI]
        WIF[Workload Identity Federation]
    end

    subgraph CSA["CSA-in-a-Box Platform"]
        subgraph Data["Data Platform"]
            DBR[Databricks - secret scopes]
            ADF[Azure Data Factory - linked services]
            FAB[Microsoft Fabric - connections]
            ADLS[ADLS Gen2 - storage keys]
        end
        subgraph AI["AI & Analytics"]
            AOI[Azure OpenAI - API keys]
            PBI[Power BI - service principal]
            AIS[Azure AI Search - admin keys]
        end
        subgraph Gov["Governance"]
            PUR[Purview - scan credentials]
            MON[Azure Monitor - diagnostics]
            POL[Azure Policy - compliance]
        end
    end

    AKV --> Data
    AKV --> AI
    AKV --> Gov
    MI --> Data
    MI --> AI
    MI --> Gov
    ROT --> SEC

What CSA-in-a-Box gains from Key Vault migration:

Key Vault tier selection guide¶

Choosing the right Key Vault tier is the first architectural decision. The tier determines HSM backing, compliance posture, and cost structure.

Decision flowchart¶

flowchart TD
    START[Start] --> Q1{Need FIPS 140-3<br/>Level 3 HSM?}
    Q1 -->|No| STD[Key Vault Standard<br/>Software-protected keys<br/>$0.03/10K operations]
    Q1 -->|Yes| Q2{Need dedicated<br/>HSM tenant?}
    Q2 -->|No| PREM[Key Vault Premium<br/>Multi-tenant HSM pool<br/>$1/key/month + operations]
    Q2 -->|Yes| MHSM[Managed HSM<br/>Single-tenant HSM<br/>$3.20/HSM unit/hour]

    STD --> USE_STD[Dev/test environments<br/>Non-regulated workloads<br/>Cost-sensitive scenarios]
    PREM --> USE_PREM[Production workloads<br/>FedRAMP High / IL4<br/>CMMC Level 2<br/>Most federal agencies]
    MHSM --> USE_MHSM[IL5 classified workloads<br/>CMMC Level 3<br/>Regulatory mandate for<br/>dedicated HSM<br/>BYOK sovereignty]

Tier comparison¶

When to use each tier¶

Key Vault Standard is appropriate for:

• Development and testing environments
• Non-regulated commercial workloads where software-protected keys are acceptable
• Cost-sensitive scenarios with moderate secret volumes
• Scenarios where HSM backing is not a compliance requirement

Key Vault Premium is appropriate for:

• Production workloads in regulated industries
• Federal agencies requiring FedRAMP High authorization
• CMMC Level 2 compliance (most DoD contractors)
• IL4 workloads in Azure Government
• Any scenario requiring HSM-backed keys without dedicated HSM hardware

Managed HSM is appropriate for:

• IL5 classified data processing
• CMMC Level 3 (advanced) requirements
• Regulatory mandates for dedicated, single-tenant HSM hardware
• BYOK scenarios requiring full key sovereignty
• Financial services with HSM custody requirements
• Organizations with existing on-premises HSM infrastructure requiring cloud parity

Migration timeline overview¶

A typical Vault-to-Key Vault migration follows a phased approach. Timeline varies based on Vault complexity, number of applications, and compliance requirements.

For simpler deployments (OSS Vault, KV secrets only, few applications), the timeline can compress to 8-12 weeks by skipping phases that do not apply.

Navigation¶

Strategic¶

• Why Key Vault over Vault (Executive Brief) -- The strategic case for migration, covering IBM acquisition uncertainty, managed infrastructure advantages, managed identity, and FIPS 140-3 Level 3 HSM.
• Total Cost of Ownership Analysis -- Three-year TCO comparing Vault Enterprise (per-node licensing, Consul backend, admin FTE) with Key Vault Standard/Premium/Managed HSM.

Feature reference¶

• Complete Feature Mapping (40+ features) -- Every Vault secrets engine, auth method, policy mechanism, and operational feature mapped to its Azure Key Vault equivalent.

Migration guides¶

• Secrets Migration -- Static secrets from Vault KV v1/v2 to Key Vault secrets, including versioning, rotation policies, soft-delete, and RBAC.
• PKI Migration -- Vault PKI engine to Key Vault certificates, CA migration, ACME protocol, and integration with App Service, AKS, and API Management.
• Dynamic Secrets to Managed Identity -- Eliminating stored database credentials entirely using Azure managed identity for SQL, PostgreSQL, and Cosmos DB.
• Encryption Migration -- Vault Transit engine to Key Vault keys, covering encrypt/decrypt API migration, key types, rotation, envelope encryption, and BYOK.
• Policy Migration -- Vault path-based policies to Azure RBAC role assignments, Entra groups, PIM just-in-time access, and Azure Policy governance.

Tutorials¶

• Tutorial: Secret Migration (Step-by-Step) -- Export secrets from Vault, create Key Vault with Bicep, import secrets with Python, configure RBAC, update application references, and validate.
• Tutorial: Managed Identity for Zero Stored Secrets -- Replace Vault dynamic database credentials with Azure managed identity for SQL, PostgreSQL, and Cosmos DB.

Federal and compliance¶

• Federal Migration Guide -- Key Vault in Azure Government, FIPS 140-3 Level 3 (Premium/Managed HSM), IL4/IL5, CMMC, FedRAMP key management controls.

Operational¶

• Best Practices -- Incremental migration strategy, managed identity adoption ladder, Key Vault networking (private endpoints), backup and recovery, CSA-in-a-Box secrets integration patterns.

Related resources¶

• Migration playbook (concise): Vault to Key Vault Playbook
• Migration index: All migration guides
• CSA-in-a-Box identity and secrets flow: Reference Architecture
• CSA-in-a-Box compliance matrices:
  • NIST 800-53 Rev 5
  • FedRAMP Moderate
  • CMMC 2.0 Level 2
• Key rotation runbook: Runbook
• Microsoft Learn:
  • Azure Key Vault documentation
  • Managed identity overview
  • Key Vault best practices
  • Managed HSM documentation
  • Key Vault security baseline

Maintainers: csa-inabox core team Last updated: 2026-04-30