Key Vault
In-region resiliency (including zone spread, where supported) is fully automatic and not user-configurable. Cross-region DR does not exist as a platform feature — you build and maintain a second vault yourself.
Standard/Premium vault (default)
Microsoft transparently replicates vault data within the region across fault domains — no configuration required or available.
- Replication
- Synchronous
- RPO
- 0
- RTO
- Near-instant — fully platform-managed
- Failover trigger
- Automatic
Built-in intra-region zone replication
In regions with Availability Zones, Microsoft automatically spreads replicas across zones. There is no separate SKU, toggle, or setting to enable or verify this — it's simply how the service behaves where AZs exist.
- Replication
- Synchronous
- RPO
- 0
- RTO
- Near-instant — fully platform-managed, not customer-observable
- Failover trigger
- Automatic
You cannot confirm zone redundancy is active for a specific vault through the portal or API — it's implicit to the region.
No native feature — customer-built secondary vault
There is no cross-region replication or failover for Key Vault. The standard pattern is a second vault in another region, kept in sync via IaC, backup/restore, or application-side dual-write.
- Replication
- N/A
- RPO
- Entirely dependent on your replication/sync process
- RTO
- Entirely dependent on your process — app config must also be repointed to the secondary vault
- Failover trigger
- N/A
Gotchas
There's nothing to click for regional DR
Key Vault has no customer-facing failover mechanism at all. Regional DR means standing up a second vault, replicating secrets/keys/certificates (backup/restore or app-side dual-write), and updating application configuration — entirely your responsibility.
Soft-delete isn't a DR feature
Soft-delete and purge protection (mandatory since 2020) protect against accidental or malicious deletion, not a region outage — don't count them toward your regional resiliency story.
HSM-backed key backups are geography-locked
Key backup/restore for Managed HSM and Premium HSM-backed keys only works within the same Azure geography — this constrains which region your secondary vault can realistically live in if you're relying on native backup/restore rather than re-generating keys.