Azure Key Vault in the US Central region went unavailable earlier today and temporarily took down our production application because it could not connect to the vault. The service appears to be working again, and we're asking Microsoft Support for a full incident report. We're using a Premium SKU, but this still raises concerns about how often a similar failure could happen and what the best failover strategy is. I'd especially like to understand whether Key Vault provides automatic geo-redundancy to a paired region or whether additional configuration is required.
2 Answers
For production workloads, it’s worth designing for Key Vault access failures instead of assuming the service will always be available. Use retry logic with exponential backoff, cache non-rotating secrets safely where appropriate, and consider maintaining a secondary vault in another region with a tested failover process. Also check the service health details and the official incident report before deciding whether to move secrets to another cloud provider.
The Premium SKU refers to the Key Vault pricing tier; it doesn’t necessarily mean your application gets automatic cross-region failover. Key Vault may have platform-level redundancy, but you should verify the exact availability guarantees and regional failover behavior for your setup.
That’s what I’m trying to clarify with Support. I had assumed the paired-region behavior would cover this automatically, but the outage exposed how dependent the application is on the vault being reachable.
Agreed. The immediate outage was severe enough that we’re reviewing regional failover and application-side caching rather than assuming the Premium tier alone protects us.