# Azure Key Vault Unused

> Every secret read, key operation, and certificate request lands in a Key Vault's ServiceApiHit metric, so 30 days at 0 on both average and maximum means no caller depends on the vault. ZopNight also skips vaults younger than 30 days, and fires even at $0 cost because stale vaults are security surface.

Source: https://zop.dev/integrations/azure/recommendations/azure-key-vault-unused
Updated: 2026-08-19

---

## One metric counts every kind of caller

`ServiceApiHit` on a Key Vault increments for every API operation: a secret GET, a key
signing call, a certificate list. That completeness is what makes it a trustworthy abandonment
signal: 30 days at zero, on both the average and the maximum, means no application, pipeline,
or admin touched the vault. Detection is metrics-only by design; a customer tag can never
authorize deleting a credential store.

## The vault Azure zero-fills, and the age gate that counters it

Azure Monitor synthesizes a full-window zero series for a vault with no activity, which means
a vault created yesterday reads as 30 silent days. The rule counters with an age gate: when
the discoverer captured the vault's creation timestamp, anything younger than the 30-day
window abstains. The gate fails open. A vault with no timestamp is still evaluated, so a
genuinely stale orphan is never spared by missing metadata.

## Why this fires at zero dollars

Key Vault has no base fee; Azure charges per operation, so an untouched vault often computes
to $0. The rule fires anyway (orphan cleanup is exempt from ZopNight's
minimum-savings filter) because the value is risk reduction: a forgotten vault full of live
credentials is attack surface, audit noise, and a compliance question nobody can answer.

## Audit a vault's pulse

```bash
az monitor metrics list \
  --resource "$(az keyvault show -n <vault> --query id -o tsv)" \
  --metric ServiceApiHit \
  --interval PT1H --offset 30d --aggregation Average Maximum
```

## The soft-delete safety net

Deleting a vault is less final than it sounds: soft delete retains it for the configured
retention period (7 to 90 days), during which `az keyvault recover` restores everything. Export
secrets you know you need, delete, and treat the retention window as your rollback plan. If a
forgotten consumer surfaces, recovery is one command.

## Abstain list and access

Metrics fetched for the org but absent for this vault, any recorded hit, or a known-young
vault each suppress the finding. Reader and Monitoring Reader are sufficient to reproduce the
detection; ZopNight has no write access to vault contents at any point.