Azure Resiliency Map
Service catalog
Security

Key Vault

In-region resiliency (including zone spread, where supported) is fully automatic and not user-configurable. Cross-region DR does not exist as a platform feature — you build and maintain a second vault yourself.

SLA 99.99%Last verified 2026-08-13
Local

Standard/Premium vault (default)

Microsoft transparently replicates vault data within the region across fault domains — no configuration required or available.

Replication
Synchronous
RPO
0
RTO
Near-instant — fully platform-managed
Failover trigger
Automatic
Protects against: Node/disk failure
Meets tier
T0
T1
T2
T3
T4
Zonal

Built-in intra-region zone replication

In regions with Availability Zones, Microsoft automatically spreads replicas across zones. There is no separate SKU, toggle, or setting to enable or verify this — it's simply how the service behaves where AZs exist.

Replication
Synchronous
RPO
0
RTO
Near-instant — fully platform-managed, not customer-observable
Failover trigger
Automatic
Protects against: Datacenter/zone failure (in AZ-enabled regions)

You cannot confirm zone redundancy is active for a specific vault through the portal or API — it's implicit to the region.

Meets tier
T0
T1
T2
T3
T4
Regional

No native feature — customer-built secondary vault

There is no cross-region replication or failover for Key Vault. The standard pattern is a second vault in another region, kept in sync via IaC, backup/restore, or application-side dual-write.

Replication
N/A
RPO
Entirely dependent on your replication/sync process
RTO
Entirely dependent on your process — app config must also be repointed to the secondary vault
Failover trigger
N/A
Protects against: Only what you explicitly build
Meets tier
T0
T1
T2
T3
T4

Gotchas

high

There's nothing to click for regional DR

Key Vault has no customer-facing failover mechanism at all. Regional DR means standing up a second vault, replicating secrets/keys/certificates (backup/restore or app-side dual-write), and updating application configuration — entirely your responsibility.

medium

Soft-delete isn't a DR feature

Soft-delete and purge protection (mandatory since 2020) protect against accidental or malicious deletion, not a region outage — don't count them toward your regional resiliency story.

low

HSM-backed key backups are geography-locked

Key backup/restore for Managed HSM and Premium HSM-backed keys only works within the same Azure geography — this constrains which region your secondary vault can realistically live in if you're relying on native backup/restore rather than re-generating keys.

Sources