Azure naming · Microsoft.KeyVault/vaults

kv Key vault

Secrets, keys, and certificates. The name backs a public DNS label (<name>.vault.azure.net).

Naming constraints

CAF abbreviationkv
Resource typeMicrosoft.KeyVault/vaults
Length3–24 characters
CaseMixed case
Allowed charactersAlphanumerics and hyphens. Start with a letter, end with a letter or digit, no consecutive hyphens.
Uniqueness Global
SeparatorHyphen
Watch out: Globally unique, and the 24-character ceiling is tight: long workload names plus region rarely fit. Soft-deleted vaults keep their name reserved until purged.

Source: Microsoft Learn, “Naming rules and restrictions for Azure resources”, checked October 2026. Abbreviation from the Cloud Adoption Framework.

Example & copy-ready

A worked name for workload app, env prod, region weu, instance 001.

Example name
kv-app-prod-weu-001 Valid
Validation regex for CI checks or pre-commit hooks (.NET and JavaScript) 
^[A-Za-z](?!.*--)[A-Za-z0-9-]{1,22}[A-Za-z0-9]$
Bicep naming expression 
var name = take('kv-${workload}-${env}-${region}-${instance}', 24)
Terraform local 
locals {
  name = substr(join("-", compact(["kv", var.workload, var.env, var.region, var.instance])), 0, 24)
}

Azure Policy can't evaluate regular expressions, so a policy can check the kv prefix but not the full format. Run the regex in your pipeline, or audit existing names on a schedule.

« SignalR Managed identity »

Uniqueness scope

Globally unique across all of Azure — the name backs a public DNS label, so a clash with any other tenant's resource fails the deployment. Build in enough entropy (org/region/instance) to avoid collisions.

Open in the name generator

More in Security

All resource types