Key Management
The single master key that every tenant's encryption key is derived from is stored in Azure Key Vault, with an environment-variable fallback. This section is explicit about what that does and doesn't mean.
Where the master key lives
BYOVault fetches the master key from Azure Key Vault at runtime, rather than keeping it as a static configuration value. When a Key Vault URL isn’t configured, the service falls back to reading the key from an environment variable. The fetched key is cached in memory briefly to avoid a Key Vault call on every operation.
Infrastructure hardening, not BYOK
Moving the master key into Key Vault reduces the ways it could leak from BYOVault’s own infrastructure — it does not change who controls the key. There is still one shared master key behind every tenant’s derived key, controlled by BYOVault, not by you. If your requirements call for keys you generate, hold, or can revoke independently, that is not what this provides today.
How this relates to encryption
See Encryption for how the master key is turned into a per-tenant key via HKDF. Nothing about where the master key is stored changes that derivation — it changes only how the master key itself is protected at rest.