Manage Azure Key Vault Cryptographic Keys

Azure.Security.KeyVault.Keys provides .NET guidance for managing cryptographic keys and performing supported operations through Azure Key Vault or Managed HSM. It distinguishes KeyClient for management, CryptographyClient for encryption, wrapping, signing, and verification, and KeyResolver for resolving key identifiers. The illustrated SDK version is 4.7.0, which must be checked against the target project's supported package and API.

Key management includes creating RSA and elliptic-curve keys, retrieving current or specific versions, listing metadata and versions, updating properties, and planning expiration. Symmetric Oct keys and hardware protection require a compatible service and tier rather than being assumed available in every vault. Allowed key operations must match both the key algorithm and the intended task.

Use it for an explicitly scoped .NET key-management or cryptographic integration after establishing the tenant, RBAC permissions, vault capabilities, key name, version, and lifecycle requirements. RSA encryption is appropriate only for small payloads; the guide calls for authenticated envelope encryption for bulk data. A key limited to Encrypt and Decrypt cannot also sign or wrap without the corresponding permitted operations.

Version handling is part of data compatibility. Preserve key version identifiers with ciphertext and signatures, pin production operations to the required versions, and retain older keys while dependent data still needs them. Rotation creates a new version rather than eliminating the need for historical versions. Backup files are sensitive and subject to service-specific restore restrictions.

Inputs include the authorized vault URI, intended credential, key properties, algorithm, operation permissions, and the data or key material needed for a permitted operation. The package-installation example is:

dotnet add package Azure.Security.KeyVault.Keys

Azure.Identity supplies authentication support. DefaultAzureCredential is preferred over embedded secrets, with managed identity recommended where appropriate. A service-principal alternative is also illustrated, but credential values must be supplied through the actual approved configuration.

Management outputs include KeyVaultKey records, KeyProperties metadata, operation handles, backups, and new version IDs. Cryptographic calls return typed encryption, decryption, signature, verification, or wrapping results. Decrypted plaintext should be consumed without logging it. CryptographyClient can be constructed for a specific key version and reused across operations.

The cryptographic examples distinguish Encrypt and Decrypt, WrapKey and UnwrapKey, SignData and VerifyData, and signing an already computed hash. The algorithm tables cover RSA encryption, symmetric GCM options where supported, RSA and EC signatures, and RSA or AES key wrapping. Algorithm selection must follow the actual key type and service capabilities. The resolver's returned key-encryption-key interface serves wrap and unwrap; direct encryption requires a CryptographyClient with a validated key ID.

Lifecycle guidance separates soft deletion, recovery, and irreversible purge, with purge protection still applicable. Wait for asynchronous deletion or recovery outcomes rather than assuming immediate completion. Rotation policies define expiry and lifetime actions. RBAC examples distinguish Crypto Officer management, Crypto User operations, and Reader metadata access. Error handling separates missing keys, denied access, and other service failures. Related SDKs manage secrets and certificates separately, so this key library should not be treated as their replacement.