Is there a way on Azure to protect a private key so only I have the key? No one else can get the key?

I understand that this might be impossible as the code we have on Azure needs the key to validate incoming XML and sign outgoing XML and therefore that code has it. But I'm asking in the hope that there's a way to stop any individual from getting it.

I ask because I've learned over the years that occasionally someone you thought could be totally trusted, can't be.

  • You need to be very careful with Azure Key Vault. It is not designed to protect your private key. It works well with storing secret (credential, api key...), or for signing/encryption/decryption. Also consider NOT storing your private key as a secret. Here is a sort of threat I documented thuansoldier.net/?p=7462
    – EagleDev
    Mar 3, 2018 at 4:39

3 Answers 3


Azure has a feature specifically for this Azure key vault These are backed by HSMs - this is what you want. You need to assign access to the application via serviceprincipals and the usual authentication / authorisation but this is how you want to be storing keys for applications within Azure.

"With Key Vault, Microsoft doesn’t see or extract your keys."


This is a somewhat broad question and is really more of an architectural and philosophical problem. Looking for a particular product is often a bad idea on this site, so I will offer some advice.

How do you define "no one else"? Code in the app, other apps on the VM, apps in other VMs, attackers hitting your web site, apps on the VM host, data center administrators, etc.? This will scope the design of the system.

Since we're talking keys, the short and simple design is to move access to and usage of the key out of the realm of those attacking it (helpful answer, right?).

Moving outward:

  • Hardcoded into the app binaries (anyone with read on the binaries can get the keys)
  • Stored in a config file on disk (anyone with read on the config can get the keys)
  • Stored in Windows certificate store locally (only local admins can get the keys)
  • Stored in a certificate store on another machine with remote services to access (only local admins on the remote machine can get the keys)
  • In a hardware-backed security module (HSM) (no one can get the keys)

At each step you introduce boundaries and make it harder to get access to the keys. Those boundaries exist as authenticated services of some sort. Generally you hand the work off to these services and they touch the keys, that way your app doesn't.

The trade off is complexity and manageability for effective level of security.


If I understand you correctly, "no one else" means in your case "not my team" (so persons with access to source code, servers etc.).

So I see only two solutions:

Option A:

  1. Extract the signing functionality (create a signing service/server).
  2. Run this in an dedicated environment/server/vm (store the key here).
  3. Restrict access to this as required.

Option B:

Restrict access to your current server/service.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .