Azure Key Vault Keys for Java
Ground Java coding agents in secure Azure Key Vault and Managed HSM key-management workflows.
The documentation identifies DefaultAzureCredential, managed identity, least privilege, HSM use, soft delete, and recovery paths. However, examples for creation, deletion, permanent purge, writing backups to disk, and importing private key material lack user confirmation, permission preflight checks, sensitive-data handling, and recovery verification, so points are deducted.
It covers synchronous and asynchronous clients, major key operations, and some exception handling with intelligible failure categories. However, there are no skill-specific tests or reproducible results, several snippets omit imports, the environment-variable guidance is not fully aligned with hard-coded vault URLs, and edge cases and service/API compatibility are thin; static evidence therefore supports only a middling score.
The audience, Java SDK scenarios, key types, cryptographic operations, and trigger phrases are fairly clear. Non-fit boundaries, required Azure resources and RBAC prerequisites, input/output constraints, Chinese guidance, and mainland-China network reachability are not stated, so points are deducted.
The skill has front matter, MIT licensing, a version, installation notes, organized examples, error handling, best practices, and a references file. It lacks a changelog, explicit maintenance owner/update path, compatibility matrix, FAQ, and known-limitations section, and gives little progressive-loading guidance, so it is usable but incomplete.
It provides directly relevant examples for key creation, retrieval, update, deletion/recovery, rotation, import, encryption/decryption, signing/verification, and wrapping operations. Static review cannot verify compilation or execution; several examples are incomplete and production permissions and safety prerequisites are underexplained, so meaningful manual review remains necessary and the score stays within the static ceiling.
The skill includes a pinned dependency version, concrete dependencies, code samples, and error-handling examples; the repository also shows general CI, evaluation workflows, and harness tests. The supplied material does not show skill-specific committed tests, execution results, or independent corroboration, so evidence remains limited to static documentation.
- Permanent purge is irreversible; automation performing purge, deletion, rotation, or permission changes should require explicit confirmation and target validation.
- Backup and import examples handle key material, but do not specify encrypted storage, access control, lifecycle cleanup, or log redaction.
- Before use, verify actual azure-security-keyvault-keys and azure-identity compatibility, API signatures, RBAC permissions, and Key Vault versus Managed HSM capability differences.
- Core functionality depends on Azure Key Vault/Managed HSM and identity services; the supplied material does not establish mainland-China reachability or provide an offline alternative.
What does this skill do, and when should you use it?
This skill helps Java developers use the Azure Key Vault Keys SDK for cryptographic key management. It covers RSA, elliptic-curve, HSM-backed, and Managed HSM symmetric keys across their lifecycle. It also provides examples for encryption, decryption, signing, verification, key wrapping, backup and restore, import, and rotation. The guidance includes Maven setup, credential and client construction, synchronous and asynchronous access, and exception handling.
Guides an agent to add the Maven dependency, configure DefaultAzureCredential or managed identity, and create KeyClient, KeyAsyncClient, and CryptographyClient instances. It shows how to create, retrieve, update, list, delete, recover, purge, back up, restore, import, and rotate keys; configure rotation policies; and perform encryption, decryption, signing, verification, wrapping, and unwrapping. It also demonstrates handling ResourceNotFoundException and HttpResponseException, plus reading and writing a local backup file.
- A Java developer needs to create and manage RSA or EC keys in Azure Key Vault
- A security engineer needs HSM-backed keys for sensitive production workloads
- An application team needs Azure-hosted encryption, decryption, signing, or signature verification
- A platform team needs key rotation, backup, restore, soft-delete, or recovery workflows
- A Java project needs to import existing RSA key material into Key Vault
What are this skill's strengths and limitations?
- Covers the key-management lifecycle and core cryptographic operations
- Includes both synchronous and asynchronous client construction
- Addresses RSA, EC, HSM, and Managed HSM scenarios
- Includes rotation, backup and restore, import, and error-handling examples
- Provides a concrete Maven coordinate and SDK version
- Practical use requires Azure Key Vault or Managed HSM, credentials, and network access
- The source does not provide complete permission configuration, deployment instructions, or a dedicated test suite for this skill
- The scope is the Java Key Vault Keys SDK and should not be generalized to sibling skills or other Key Vault services
- The backup example reads and writes a local file, so secure backup storage remains the adopter’s responsibility
How do you install this skill?
Install the collection with npx skills add microsoft/skills, then select the required skill in the wizard. Skills are installed into the selected agent directory, such as .github/skills/ for GitHub Copilot. The source does not document a dedicated command for installing only azure-security-keyvault-keys-java. In the Java project, add the Maven dependency com.azure:azure-security-keyvault-keys:4.9.0.
How do you use this skill?
After installation, give the coding agent a focused request such as: Using the Azure Key Vault Keys Java SDK, create an HSM-protected RSA-2048 key and show encryption and decryption. Other supported trigger wording includes “Key Vault keys Java,” “encrypt decrypt Java,” “sign verify Java,” and “key rotation.” The agent can then follow the included Java patterns for credentials, vault URLs, key identifiers, and SDK operations.