Azure Compliance ControlsAzure Key Vault
Key Vault keys should have an expiration date
Cryptographic keys should have a defined expiration date and not be permanent. Keys that are valid forever provide a potential attacker with more time to compromise the key. Setting expiration dates on cryptographic keys is a recommended security practice.
What this control checks
Checks Azure Key Vault keys for an expiration date setting
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5: Authenticator Management
FedRAMP Moderate Baseline Rev 4
- IA-5 (1): Password-Based Authentication
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 8.1 Ensure that the expiration date is set on all keys
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA-5 Authenticator Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_key_expiration_set - Checkov Check:
CKV_AZURE_40 - Powerpipe Control:
azure_compliance.control.keyvault_key_expiration_set - Azure Policy Definition:
152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0 - Trivy Check:
AZU-0014
Last reviewed: 2026-10-13