Azure Key Vault Keys for .NET
Guides .NET developers in managing Azure Key Vault keys and performing cryptographic operations securely.
The document recommends managed identity, restricted KeyOperations, soft delete, and key expiration, and includes RBAC and error-handling examples. However, deletion, purge, rotation, and local backup-file operations can create significant external or sensitive-data impact without explicit confirmation, least-privilege configuration, backup protection, data-flow disclosure, or rollback guidance, so points are deducted.
The skill broadly covers client hierarchy, authentication, key management, cryptographic operations, rotation, and differentiated 404/403/general error handling. It provides no skill-specific tests, compatibility validation, abnormal-input handling, retry strategy, or reproducible key-path evidence; under static review this supports only a modest score.
The name, description, trigger terms, and .NET scenarios are fairly clear, covering key management and cryptographic operations. It does not define non-fit cases, service prerequisites, permission boundaries, or Chinese-language guidance, and its core function depends on reachable Azure Key Vault/Managed HSM services with no mainland-China reachability discussion, so points are deducted.
The document includes installation commands, layered sections, code examples, algorithm and RBAC tables, and declares MIT licensing, author, and version 1.0.0. It lacks a changelog, explicit maintenance owner and update path, an SDK/API compatibility matrix, troubleshooting guidance, and known limitations; the version is also undated, so points are deducted.
It covers creation, retrieval, update, deletion, recovery, backup, encryption/decryption, signing, verification, and rotation, making it a useful starting point for common implementations. However, examples lack complete project context, permission setup, production-safe handling, and validation results, leaving manual review and rework; static calibration caps this dimension at 7.
The skill cites NuGet, API reference, quickstart, and GitHub source locations, providing some traceability. It contains no skill-specific tests, CI coverage, or third-party execution evidence, and the referenced external material was not verified in this static review, so only limited credit is justified.
- Do not execute PurgeDeletedKeyAsync, deletion, or rotation without confirmation and a tested recovery process.
- The example writes a key backup to local key-backup.bin; production use requires explicit encryption, access control, retention, and secure-deletion policies.
- The ClientSecretCredential example contains a highly sensitive credential; clientSecret must not be hard-coded or logged.
- Before use, verify the actual APIs, permissions, service capabilities, and compatibility of Azure.Security.KeyVault.Keys 4.7.0 with Azure.Identity, and confirm Azure endpoint reachability from mainland-China networks.
What does this skill do, and when should you use it?
This skill is for .NET developers using the Azure.Security.KeyVault.Keys SDK with Azure Key Vault and Managed HSM. It covers creating, retrieving, updating, deleting, backing up, restoring, and rotating RSA, EC, and symmetric keys. It also shows how to use CryptographyClient for encryption, decryption, key wrapping, signing, and verification. The material includes Microsoft Entra credentials, service principals, RBAC roles, environment variables, and error handling.
It guides installation of Azure.Security.KeyVault.Keys and Azure.Identity, reads Key Vault configuration from environment variables, creates KeyClient and CryptographyClient instances, and calls Azure Key Vault operations. Examples cover key creation and version retrieval, property updates, soft-delete and recovery, backup and restore, rotation policies, and RSA, EC, and AES-related encryption, decryption, wrapping, unwrapping, signing, and verification. It also demonstrates writing key backups to files, reading them back, and handling 404, 403, and other RequestFailedException cases.
- A .NET engineer building Azure security features can use it to create RSA, EC, or HSM-backed keys with KeyClient.
- A developer implementing encryption, decryption, signing, or verification in a .NET service can follow its CryptographyClient examples.
- A team responsible for production key lifecycle management can use the rotation API and rotation-policy examples.
- A platform or operations engineer migrating or recovering keys can follow the backup, restore, soft-delete, and recovery examples.
What are this skill's strengths and limitations?
- Covers key lifecycle management, cryptographic operations, rotation, backup and restore, and error handling.
- Provides copyable asynchronous C# examples for KeyClient, CryptographyClient, and KeyResolver.
- Documents DefaultAzureCredential, managed identity, HSM-backed keys, soft-delete, and RBAC practices.
- Licensed under MIT and distributed as part of Microsoft's installable skills collection.
- Requires an accessible Azure Key Vault or Managed HSM, valid credentials, and appropriate RBAC permissions.
- Depends on network calls to Azure services and cannot independently provide local key custody.
- The source does not provide independent test results or platform-specific validation for this particular skill.
- The README states that the repository is under active development, so the skill may change.
How do you install this skill?
Install the skill collection with npx skills add microsoft/skills, then select this skill in the wizard; the README does not document a dedicated single-skill installation command. Install the .NET packages with dotnet add package Azure.Security.KeyVault.Keys and dotnet add package Azure.Identity. The SKILL.md identifies Azure.Security.KeyVault.Keys version 4.7.0 as stable.
How do you use this skill?
In an agent with the skill installed, try: Create a .NET Azure Key Vault example using DefaultAzureCredential for RSA encryption, decryption, and key rotation. Set KEY_VAULT_NAME; when using DefaultAzureCredential in production, also set AZURE_TOKEN_CREDENTIALS=prod or configure a specific credential. Grant the required Key Vault Crypto Officer, Key Vault Crypto User, or Key Vault Reader RBAC role for the operations you need.