How Google Cloud KMS and Azure Key Vault differ on scope, key custody, deployment and cost.
| Google Cloud KMS | Azure Key Vault | |
|---|---|---|
| Type | Cloud KMS | Cloud KMS |
| Scope | Encryption keys | Keys, secrets, certificates |
| Deployment | SaaS (GCP) | SaaS (Azure) |
| Key custody | HSM tier FIPS 140-2 Level 3; External Key Manager for off-cloud keys | Premium tier: FIPS 140-2 Level 2/3 HSMs; Managed HSM available |
| How it works | Key rings and key versions with explicit rotation, offered in software, HSM and external tiers. External Key Manager is the differentiator: the key stays in your own system and Google calls out to it, so the cloud can be denied access by design rather than by policy. | One service holding three different things: cryptographic keys, arbitrary secrets and TLS certificates. Standard is software-protected, Premium is HSM-backed, and Managed HSM gives a single-tenant pool. Certificate lifecycle is included, which the other clouds keep separate. |
| Pricing* | Metered per key version + operations | Metered per operation; Premium adds HSM |
| Free tier | No | No |
| Licence | — | — |
| Best for | GCP workloads and hold-your-own-key rules | Microsoft-centric estates |
Choose Google Cloud KMS for gcp workloads and hold-your-own-key rules. Choose Azure Key Vault for microsoft-centric estates.
* Published list pricing (vendor pricing pages, August 2026).