Features Overview¶

Key Vault Scan

Scan all Key Vaults across subscriptions. Find secrets, keys, and certificates with expiration tracking.

Available in all tiers

Compliance Scoring

Automated security assessments with evidence mapped to HIPAA, PCI-DSS, SOC 2, ISO 27001, NIST 800-53, the CIS Azure Foundations Benchmark and the Microsoft Cloud Security Benchmark.

Available in all tiers

Alerts

Email and webhook notifications for expiring credentials, failed scans, and compliance violations.

Available in all tiers

Audit Logging

Complete audit trail of all user actions and system events.

Available in all tiers

Dependencies

Map which Azure resources (App Services, Functions, SQL, Container Apps, Azure DevOps) use each Key Vault secret.

PRO and ENTERPRISE tiers

Secret Rotation

Rotate App Registration secrets and update all linked Key Vaults. 3 manual rotations/month on STARTER, unlimited on PRO and ENTERPRISE. Also monitor Enterprise Application credentials, active SAML signing certificates, and owners on STARTER+.

Available in all tiers (limited on STARTER)

Certificate Renewal

Renew a Key Vault certificate from its page, whoever issues it: a new self-signed version, an order through a CA connected to Key Vault, or a request you send to any other CA. The old version stays on for a grace period, or while something still points at it.

PRO and ENTERPRISE

Multi-Cloud Sync

Sync Azure Key Vault secrets to AWS Secrets Manager and GCP Secret Manager, and certificates to AWS Certificate Manager and GCP Certificate Manager. Replication copies items to a second Key Vault in the same tenant.

PRO and ENTERPRISE tiers