Azure Key Vault is Microsoft's managed service for secrets, keys and certificates, billed per operation, key and renewal. Pages here cover replacing it with self-hosted OpenBao or Infisical.
Comparing Azure Key Vault with self-hosted OpenBao for application secrets, encryption keys and certificates: Entra ID versus OpenBao auth methods, dynamic secrets that Key Vault lacks, HSM options, throttling limits, availability design and who operates it.
Comparing Azure Key Vault with self-hosted Infisical: developer-facing projects and environments, secret syncs, rotation and dynamic secrets, PKI and KMS features, Kubernetes delivery, and what Infisical's enterprise license adds against Key Vault's per-operation billing.
Moving secrets, keys and certificates out of Key Vault into OpenBao: reading secret values through the API because backups only restore inside Azure, planning for keys that must be re-created rather than copied, switching applications from managed identity to OpenBao auth methods, and cutover order.
Cost by component: Key Vault operations, HSM-protected keys, certificate renewals and Managed HSM pools at published Azure prices, against OpenBao's servers, storage, optional HSM, setup and on-call operations, with the volume at which each side is cheaper.
What leaves Key Vault and what does not: backup blobs that only restore in the same subscription and geography, secret values readable through the API, keys that have to be re-created, the 500-version backup limit, and soft-delete retention to plan before the vault is removed.
Replacing Key Vault certificate issuance and renewal, billed per renewal request, with OpenBao's PKI secrets engine or Infisical's private PKI: short-lived certificates, ACME enrollment, integration with public CAs and what changes for App Service and other Azure consumers.
For organizations with workloads in Azure, other clouds and on premises: running one OpenBao or Infisical service with cloud auth methods instead of a Key Vault per subscription, and keeping Azure services that need customer-managed keys in Key Vault.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.