Azure Security Center rather identifies insecure configurations (e.g. missing system updates) than concrete vulnerabilities. While Nessus authenticated scans also cover insecure configurations, they additionally discovers vulnerable installed software (e.g. through CVE matching).
I dont think that the Azure Security Center sees itself as vulnerability ...
It looks to me like you need to have everything authorized.
If an Agency purchases an outsourced service (software) that is built
on top of a cloud platform, how is that handled within FedRAMP?
Obtaining a FedRAMP authorization requires all system components be
assessed based on the control requirements in the ...
You don't make clear exactly how you intend using Key-Vault.
As a general guide to encryption you should always ask the question, "Who has the keys?"
Many storage services offer to perform encryption for you, but if the encryption is not with your keys, it's not your protection.