How to enable the Rotation policy for the Azure Managed HSM Keys?

Question

I have created the Azure Managed HSM and created the keys and myself have 'Managed HSM Crypto User' role but not able to see Rotation Policy enabled in the portal. Please advice any thing is missing.

KEYS

ROLES

Answer 1

@Anonymous

Thank you for your post!

When it comes to configuring the key rotation policy within your Azure Managed HSM, as of now this can only be accomplished from Azure CLI version 2.42.0 or above.

---

Configure a key rotation policy:

Write a key rotation policy and save it to a file. Use ISO8601 Duration formats to specify time intervals.

• For example: Rotate the key 18 months after creation and set the new key to expire after two years.

{
  "lifetimeActions": [
    {
      "trigger": {
        "timeAfterCreate": "P18M",
        "timeBeforeExpiry": null
      },
      "action": {
        "type": "Rotate"
      }
    }
  ],
  "attributes": {
    "expiryTime": "P2Y"
  }
}

Use the following command to apply the policy to a key.

az keyvault key rotation-policy update --hsm-name <hsm-name> --name <key-name> --value </path/to/policy.json>

Rotation on demand

• Once a rotation policy is set for the key, you can also rotate the key on-demand. You must set a key rotation policy first.

az keyvault key rotate --hsm-name <hsm-name> --name <key-name>

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.