Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,283 questions
Azure CAF right implementation
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 65%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJP%3C/text%3E%3C/svg%3E)
Julien POLYCARPE
1
Reputation point
Hello!
I have been reading the Cloud Adoption Framework for few weeks now and I have come accross a problem : I need to implement an enterprise scale architecture and I have seen two different ones : one in the CAF, and one in the Microsoft GitHub repository; I would like to know which one is "right". In one implementation, the key vault is in the Management subscription, and in the other one, in the Identity subscription. Apart from that, they seem to be the same. You can see both in the attachements.
Thank you very much,
Julien Polycarpe
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 44%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Saurabh Sharma 23,816 Reputation points Microsoft Employee2021-05-04T00:56:41.963+00:00 Hi @Julien POLYCARPE ,
Thanks for using Microsoft Q&A !!
Can you please share the GitHub samples you are referring to. In my opinion you can keep it in any of the subscriptions. Do you know what's the purpose of having managed subscription and identity subscription in both the scenarios and what all resources are advised to keep in those two subscriptions ? also, What exactly you want to store in your Azure Key Vault and for which all resources ?Thanks
Saurabh -
Saurabh Sharma 23,816 Reputation points Microsoft Employee
2021-05-07T23:01:26.467+00:00 Hi @Julien POLYCARPE ,
We haven't heard back from you. Just wanted to check if you have any other questions.Thanks
Saurabh -
Julien POLYCARPE 1 Reputation point
2021-05-21T07:15:29.97+00:00 Hello Saurabh,
Sorry for the late answer, I have been pretty busy. In the management subscription we plan to deploy everything linked to monitoring (dashboards, log analytics...).
Here are the samples I used as a reference :
https://github.com/Azure/Enterprise-Scale/blob/main/docs/reference/adventureworks/README.md
https://video2.skills-academy.com/fr-fr/azure/cloud-adoption-framework/ready/enterprise-scale/architectureI only have one question : if I deploy a new app in one landing zone, and that this app needs to use some secrets, do these secrets need to be centralized in a ressource group with all of my key vaults (one per app) in the identity subscription, or is it better to create one key vault in each landing zone please?
Thank you very much,
Julien
Sign in to comment
Sign in to answer