Microsoft says it "doesn't see or extract your keys". Maybe it's the ex-lawyer in me, but to me doesn't doesn't mean can't(*). I'm not interested in policies, contracts, audit trails, etc.
Can't means it's cryptographically impossible, i.e., a zero-knowledge scheme that would require someone with complete unfettered access to the Azure backend - the Platonic attacker, or more terrifying, someone enforcing a subpoena - to nonetheless have to crack a password or something else only in the possession of authorized key vault accessors.
Does anyone know if Microsoft - in theory, in principle - can see Key Vault contents?
(*) Yes, you may bring on the "it depends on what the meaning of the word is, is" jokes.
Reading about Managed HSM pools, they state:
Isolated access control: Managed HSM "local RBAC" access control model allows designated HSM cluster administrators to have complete control over the HSMs that even management group, subscription, or resource group administrators cannot override.
This sounds promising, but they don't state Microsoft cannot override...
Consider whether your customer/client wants to ensure their data is safe from a search warrant, subpoena, etc. Perhaps your client is a government. Being on the cloud doesn't in principle mean you have to trust the cloud provider with the keys (literally) to your kingdom, but the fact that they don't seem to warrant this kind of privacy and no one seems to know the answer leads me to suspect that that's exactly what you do when you use key vault.
Perhaps the only real solution is to store your data on AWS and use Azure to store the keys, or vice versa. At least then Bezos and Nadella would have to conspire together to read your data.
