specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
provider: Azure Key Vault
providerId: azure-key-vault
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Security
  - Secrets Management
  - HSM
  - FinOps
  - FOCUS
description: 'FOCUS-aligned FinOps for Azure Key Vault: per-10K-transaction usage metering for secrets,
  software keys, HSM-protected keys, and certificates, plus partition-hour billing for Managed HSM. Charges
  flow into the standard Azure invoice.'
sources:
  - https://azure.microsoft.com/en-us/pricing/details/key-vault/
  - https://learn.microsoft.com/en-us/azure/key-vault/general/service-limits
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
publisherName: Microsoft Corporation
serviceCategory: Security
billingModel:
  pricingCategory: Pay-As-You-Go
  billingFrequency: Monthly
  billingCurrency: USD
  chargeCategories:
    - Usage
    - Tax
    - Adjustment
focusColumns:
  ServiceName: Azure Key Vault
  ServiceCategory: Security
  ProviderName: Microsoft
  PublisherName: Microsoft Corporation
  InvoiceIssuerName: Microsoft Corporation
  PricingCategory: Pay-As-You-Go
  BillingCurrency: USD
  ChargeCategory: Usage
meters:
  - name: secret_operations
    description: Get/set/list secret operations
    unit: operation
    aggregation: sum
    dimensions:
      - vault
      - region
      - operation_type
  - name: software_key_operations
    description: Software-protected key crypto operations
    unit: operation
    aggregation: sum
    dimensions:
      - vault
      - region
      - key_type
      - key_size
  - name: hsm_key_operations
    description: HSM-protected key crypto operations (Premium / Managed HSM)
    unit: operation
    aggregation: sum
    dimensions:
      - vault
      - region
      - key_type
      - key_size
  - name: hsm_key_storage
    description: HSM-protected keys stored in Premium vault per month
    unit: key-month
    aggregation: avg
    dimensions:
      - vault
      - region
  - name: certificate_operations
    description: Certificate create / get / renew operations
    unit: operation
    aggregation: sum
    dimensions:
      - vault
      - region
  - name: certificate_renewals
    description: Auto-renew issuances; metered separately from create
    unit: renewal
    aggregation: sum
  - name: managed_hsm_partition_hours
    description: Single-tenant Managed HSM partition active hours
    unit: partition-hour
    aggregation: sum
    dimensions:
      - hsm_pool
      - region
principles:
  - name: Visibility
    description: Use Azure Monitor diagnostic logs and Log Analytics to track per-vault transaction volume
      by operation type; correlate with Cost Management cost-per-operation roll-ups.
  - name: Allocation
    description: Tag vaults by application / team; use one vault per workload to keep cost attribution
      clean and respect throttling boundaries.
  - name: Optimization
    description: Cache secrets at the application tier; consolidate low-volume vaults; use software-protected
      keys instead of HSM where compliance allows; size Managed HSM partitions to actual demand to avoid
      idle hours.
  - name: Accountability
    description: Assign vault owners through Azure RBAC; review high-transaction vaults monthly; alert
      on unusual operation volume which may signal cost or security incidents.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com