Check ID: keyvault_key_rotation_enabled
Provider: Azure
Service: keyvault
Severity: HIGH
Categories: encryption
Resource type: microsoft.keyvault/vaults/keys

What this check verifies

Each Azure Key Vault key is assessed for a rotation policy that includes a Rotate lifetime action scheduling automatic key version creation.

Risk

Without auto-rotation, keys may outlive policy, increasing exposure if material is leaked and weakening confidentiality. Expired keys without planned rollover can break decrypt/unwrap operations, impacting availability. Long-lived keys hinder incident response and enable prolonged misuse of stale versions.

Recommendation

Define a per-key rotation policy to automatically Rotate on a fixed cadence (e.g., P2Y) and set an expiry to enforce lifecycle. Use versionless key URIs in dependent services, apply least privilege to rotation roles, enable near-expiry notifications, and monitor events for defense in depth.

Remediation

az keyvault key rotation-policy update --vault-name <VAULT_NAME> --name <KEY_NAME> --value '{"lifetimeActions":[{"trigger":{"timeAfterCreate":"P18M"},"action":{"type":"Rotate"}}]}'

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = keyvault_key_rotation_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks