Azure Compliance ControlsAzure Key Vault
Key vault certificates should have 'Validity Period (in months)' set to 12 or less
Manage your organizational compliance requirements by specifying the maximum amount of time that a certificate can be valid within your key vault. Azure Policy parameter `maximumValidityInMonths` has a `defaultValue` of 12.
What this control checks
Key vault certificate validity period setting; the default is 12 months
Framework mappings
The clauses this control is mapped to in each framework.
FedRAMP Moderate Baseline Rev 4
- IA-5 (1): Password-Based Authentication
- 8.3.11 Ensure certificate 'Validity Period (in months)' is less than or equal to '12'
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_certificate_validity_period_less_equal_12_months - Powerpipe Control:
azure_compliance.control.keyvault_certificate_validity_period_less_equal_12_months - Azure Policy Definition:
0a075868-4c26-42ef-914c-5bc007359560
Last reviewed: 2026-10-13