---
title: Azure Key Vault
description: Track key Azure Key Vault metrics.
breadcrumbs: Docs > Integrations > Azure Key Vault
---

# Azure Key Vault

## Overview{% #overview %}

Azure Key Vault is used to safeguard and manage cryptographic keys and secrets used by cloud applications and services.

Use the Datadog Azure integration to collect metrics from Azure Key Vault.

## Setup{% #setup %}

### Installation{% #installation %}

If you haven't already, set up the [Microsoft Azure integration](https://docs.datadoghq.com/integrations/azure/). No additional installation steps are required.

## Data Collected{% #data-collected %}

### Metrics{% #metrics %}

|  |
|  |
| **azure.keyvault\_vaults.service\_api\_hit**(count)          | Number of total service api hits*Shown as request*            |
| **azure.keyvault\_vaults.service\_api\_latency**(gauge)      | Overall latency of service api requests*Shown as millisecond* |
| **azure.keyvault\_vaults.service\_api\_result**(count)       | Number of total service api results*Shown as response*        |
| **azure.keyvault\_vaults.saturation\_shoebox**(gauge)        | Vault capacity used*Shown as percent*                         |
| **azure.keyvault\_vaults.availability**(gauge)               | Vault requests availability*Shown as percent*                 |
| **azure.keyvault\_vaults.count**(gauge)                      | The count of all Azure Key Vault resources                    |
| **azure.keyvault\_managedhsms.availability**(gauge)          | Service requests availability*Shown as percent*               |
| **azure.keyvault\_managedhsms.service\_api\_hit**(count)     | Number of total service api hits*Shown as request*            |
| **azure.keyvault\_managedhsms.service\_api\_latency**(gauge) | Overall latency of service api requests*Shown as millisecond* |

### Events{% #events %}

Datadog sends *credential expiry events* to help you monitor upcoming expirations for Azure app registrations, Key Vault keys, Key Vault secrets, and Key Vault certificates. To receive events for Key Vault keys, secrets, and certificates, you must install the *Azure Key Vault* integration.

- **Expiration events** are sent 60, 30, 14, 7, and 1 day(s) before credential expiration, and once after expiration.
- **Missing permission events** are sent every 15 days and lists the Key Vaults for which Datadog lacks the required permissions. If no changes are made to Key Vault permissions during the previous 15-day cycle, the event notification is not sent again.

You can view these events in [Event Explorer](https://app.datadoghq.com/event/explorer?query=status%3Awarn%20source%3Aazure).

**Notes**:

- To collect Azure app registration expiration events, [enable access to the Microsoft Graph API](https://docs.datadoghq.com/integrations/guide/azure-graph-api-permissions/).
- If a certificate and its associated key and secret expire at the exact same time, one expiration event is sent for each resource.

### Service Checks{% #service-checks %}

The Azure Key Vault integration does not include any service checks.

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).

## Further Reading{% #further-reading %}

- [Monitor expiration events from Azure Key Vault](https://www.datadoghq.com/blog/azure-key-vault-monitoring-events/)