Reestablish Key Vault autorotation settings after regional recreation

Source facts

Azure Key Vault does not provide an in-place regional relocation. Microsoft’s approach creates a new vault alongside the associated services’ relocation. Backup and restore do not retain autorotation settings. The target vault also requires its access, network, soft-delete and purge-protection configuration to be reestablished. Microsoft Learn.

Applicability

Use this check as part of a regional recreation plan, not as permission to copy a key between arbitrary locations. Have the vault owner verify the applicable object-transfer method and geography constraints before relying on backup and restore. Separate the object inventory from its continuing rotation configuration.

DSE recommendation

DSE recommends recording the source’s intended rotation configuration before creating the target vault. Compare the target settings against that record after the supported object-transfer or regeneration process. Assign ownership for any deliberate difference rather than treating the presence of the expected keys as proof that their maintenance policy survived. Review application references and required access with the relevant service owners before cutover.

Verification

Inspect the target vault’s actual rotation configuration and required objects independently. Use an approved test object and consumer to evaluate the intended ongoing process without rotating production material merely to collect evidence. Preserve the configuration comparison and unresolved exceptions. Keep retirement of the source vault as a separate decision until the migration owner has verified the required objects, settings and consumer access.

Official references

Microsoft Learn. Source retrieved September 9, 2026.