Azure Compliance ControlsAzure Key Vault
Key Vault secrets should have an expiration date
Secrets should have a defined expiration date and not be permanent. Secrets that are valid forever provide a potential attacker with more time to compromise them. It is a recommended security practice to set expiration dates on secrets.
What this control checks
Key Vault secrets must have an expiration date set and not be permanent.
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5: Authenticator Management
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
FedRAMP Moderate Baseline Rev 4
- IA-5 (1): Password-Based Authentication
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.1.h Public Key Infrastructure (PKI)
- 8.2 Ensure that the expiration date is set on all Secrets
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA-5 Authenticator Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_secret_expiration_set - Checkov Check:
CKV_AZURE_41 - Powerpipe Control:
azure_compliance.control.keyvault_secret_expiration_set - Azure Policy Definition:
98728c90-32c7-4049-8429-847dc0f4fe37 - KICS Query:
dfa20ffa-f476-428f-a490-424b41e91c7f - Trivy Check:
AZU-0017
Last reviewed: 2026-10-13