How OpenBao and Azure Key Vault differ on scope, key custody, deployment and cost.
| OpenBao | Azure Key Vault | |
|---|---|---|
| Type | OSS secrets platform | Cloud KMS |
| Scope | Secrets, keys, PKI | Keys, secrets, certificates |
| Deployment | Self-hosted | SaaS (Azure) |
| Key custody | PKCS#11 auto-unseal in community builds | Premium tier: FIPS 140-2 Level 2/3 HSMs; Managed HSM available |
| How it works | Forked from the last MPL-licensed Vault release and developed under Linux Foundation governance. The API and concepts are the ones your team already knows, which makes migration realistic rather than theoretical — the point of the project is that no single company can change the terms again. | One service holding three different things: cryptographic keys, arbitrary secrets and TLS certificates. Standard is software-protected, Premium is HSM-backed, and Managed HSM gives a single-tenant pool. Certificate lifecycle is included, which the other clouds keep separate. |
| Pricing* | Free | Metered per operation; Premium adds HSM |
| Free tier | Yes | No |
| Licence | MPL-2.0 | — |
| Best for | Vault semantics without licence risk | Microsoft-centric estates |
Choose OpenBao for vault semantics without licence risk. Choose Azure Key Vault for microsoft-centric estates.
* Published list pricing (vendor pricing pages, August 2026).