How Azure Key Vault and HashiCorp Vault differ on scope, key custody, deployment and cost.
| Azure Key Vault | HashiCorp Vault | |
|---|---|---|
| Type | Cloud KMS | Secrets platform |
| Scope | Keys, secrets, certificates | Secrets, keys, PKI, dynamic credentials |
| Deployment | SaaS (Azure) | Self-hosted + HCP |
| Key custody | Premium tier: FIPS 140-2 Level 2/3 HSMs; Managed HSM available | HSM auto-unseal and seal wrap in Enterprise |
| How it works | One service holding three different things: cryptographic keys, arbitrary secrets and TLS certificates. Standard is software-protected, Premium is HSM-backed, and Managed HSM gives a single-tenant pool. Certificate lifecycle is included, which the other clouds keep separate. | A secrets engine rather than a key store: it issues short-lived database credentials, cloud tokens and certificates on demand, so secrets expire instead of sitting in a config file. Transit lets it act as an encryption service too. Powerful, and heavy to run properly. |
| Pricing* | Metered per operation; Premium adds HSM | Community free (BUSL); HCP by quote |
| Free tier | No | Yes |
| Licence | — | BUSL-1.1 — not OSI-approved |
| Best for | Microsoft-centric estates | Dynamic, short-lived credentials at scale |
Choose Azure Key Vault for microsoft-centric estates. Choose HashiCorp Vault for dynamic, short-lived credentials at scale.
* Published list pricing (vendor pricing pages, August 2026).