Estate policy requires every RSA key in Key Vault to be scheduled t…

Question

Estate policy requires every RSA key in Key Vault to be scheduled to rotate within 730 days. Which governance approach should the security engineer use?

Accepted Answer

Assign the built-in Azure Policy that audits keys without a timely rotation policy, understanding the typical effect is Audit rather than silently rotating existing keys. — Want every RSA key on a 730-day rotation diet? Assign the built-in Policy that audits keys missing a timely rotation policy—it flags gaps; it doesn’t quietly rotate them for you.

Answer

Rely on operators to remember which keys lack rotation policies without Policy assignments.

Answer

Enable Microsoft Sentinel UEBA only, because it replaces Key Vault rotation governance.

Answer

Delete every RSA key older than 30 days regardless of application dependencies.

Estate policy requires every RSA key in Key Vault to be scheduled to rotate within 730 days. Which governance approach should the security engineer use?

Short Explanation

Full Explanation