Entra Key Vault Key Rotation Policy to Rotating the Storage Account Key

Question

I created a Key Vault and granted my storage account the Key Vault Officer role. I then setup a rotation policy as outline in the article below. I see versions of keys listed in Key Vault but the last rotation time stamp on the storage account key is from 100+ days ago so the policy is not actually rotating the key. Even manually clicking on rotate keys in the policy makes it look like it runs but the time stamp on the storage account key remains unchanged.

What am I missing ???

https://www.techtarget.com/searchcloudcomputing/tutorial/How-to-perform-and-automate-key-rotation-in-Azure-Key-Vault

Answer 1

Hi @rr-4098 , please make sure that the policy is correctly applied to the key. You can verify this by checking the policy details for the key in the Azure portal or by using the Azure CLI command az keyvault key rotation-policy show.

Also double check that the key is being used by the storage account. You can check this by going to the storage account in the Azure portal, selecting "Access keys" and verifying that the key you are rotating is being used for encryption.

If both of these steps are correct, it's possible that the policy is not being triggered due to the expiration time not being reached or the time interval not being set correctly. Verify this as well.

Please let me know your results and I can help you further!

Best,

James