Key vault certificates should have 'Validity Period (in months)' set to 12 or less
Manage your organizational compliance requirements by specifying the maximum amount of time that a certificate can be valid within your key vault. Azure Policy parameter `maximumValidityInMonths` has a `defaultValue` of 12.
Certificates with lengthy validity periods aren't best practice. Manage your organizational compliance requirements by specifying the maximum amount of time that a certificate can be valid within your key vault.
What this control checks
Key vault certificate validity period setting; the default is 12 months
Common pitfalls
Effect defaults to Audit
'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. The effect parameter has a defaultValue of "Audit".
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Certificates should have the specified maximum validity period" (0a075868-4c26-42ef-914c-5bc007359560); PowerPipe control azure_compliance.control.keyvault_certificate_validity_period_less_equal_12_months.
Framework-specific interpretation
FedRAMP Moderate Baseline Rev 4: Mapped to IA-5 (Authenticator Management).
Framework mappings
The clauses this control is mapped to in each framework.
FedRAMP Moderate Baseline Rev 4
- IA-5 (1): Password-Based Authentication
- 8.3.11 Ensure certificate 'Validity Period (in months)' is less than or equal to '12'
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_certificate_validity_period_less_equal_12_months - Powerpipe Control:
azure_compliance.control.keyvault_certificate_validity_period_less_equal_12_months - Azure Policy Definition:
0a075868-4c26-42ef-914c-5bc007359560
Last reviewed: 2026-10-13