- Use separate keyvault per application or per environment
- Lock down access to your subscription, resource group, and key vaults using role-based access control (RBAC).
- Assign RBAC roles at Key Vault scope for applications, services, and workloads requiring persistent access to Key Vault.
- Assign just-in-time eligible RBAC roles for operators, administrators and other user accounts requiring privileged access to Key Vault.
- Restrict network access with Private Link, firewall and virtual networks.
- Turn on purge protection to guard against malicious or accidental deletion of the secrets and key vault even after soft-delete is turned on.
- Purge protection prevents malicious and accidental deletion of vault objects for up to 90 days.
- Provide only required access on secret, certificate and keys at access policy level.
- Enabled the logging and monitoring for the keyvault you that you can track each activity.
