Console & adminCustomer-managed keysAzure Key Vault

Customer-managed keys: Azure Key Vault

⚠️
Preview — this feature is being built; the design below is the spec.

This page sets up an Azure Key Vault key to protect your organization’s stored Syntic content. How customer-managed keys work is on Customer-managed keys.

Before you start

  • An Azure subscription with a Key Vault (or permission to create one) using Azure role-based access control.
  • Permission to assign roles on the vault, for example Key Vault Administrator.
  • An Owner of the Syntic organization to register the key.

Add Syntic’s application to your tenant

In the Console, open Settings → Security → Encryption, select Use my own key and choose Azure. Follow the consent link to add Syntic’s application to your Microsoft Entra tenant; the page then shows the application’s name and id.

Create a key

Create an RSA key (3072 bits or more) in a vault with soft delete and purge protection turned on:

az keyvault key create \
  --vault-name acme-kv \
  --name syntic-content \
  --kty RSA --size 3072 \
  --ops wrapKey unwrapKey

Envelope encryption only needs wrapKey and unwrapKey; limiting the key’s operations to those two follows least privilege.

Grant the application access to this key

az role assignment create \
  --role "Key Vault Crypto Service Encryption User" \
  --assignee "<application id shown in the Console>" \
  --scope "$(az keyvault show --name acme-kv --query id -o tsv)/keys/syntic-content"

Where your policies allow, limit the assignment’s scope to this one key instead of the vault.

Register it with Syntic

curl -sS -X PUT https://app.syntic.ai/v1/organizations/encryption_key \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -H "syntic-beta: admin-2026-11-01" \
  -d '{"provider": "azure",
       "key_ref": "https://acme-kv.vault.azure.net/keys/syntic-content",
       "reencrypt_existing": true}'

Use the key URL without a version so that rotated versions are picked up automatically.

Operating the key

  • Audit: turn on diagnostic logging for the vault to record each wrap and unwrap operation.
  • Rotation: configure a rotation policy on the key; new versions are used for new data keys, older versions still unwrap older data.
  • Cutting access: removing the role assignment or disabling the key makes protected content unreadable within about 5 minutes; the status becomes revoked.
⚠️

Purge protection prevents anyone, including an attacker with vault access, from permanently deleting the key during the retention period. Keep it on.

Related

AWS KMSMCP policy
Was this page helpful?