Clarification Required on Azure Subscription Pricing for Azure Key Vault Integration

Question

Hi,

We are evaluating Azure Key Vault integration with Azure DevOps Variable Groups for our automation framework and need some clarification regarding the Azure subscription and its associated charges.

Our use case:

• We need to create an Azure Key Vault to store secrets used by Azure DevOps Variable Groups.

The Key Vault setup will be performed only once.

Our automation framework will subsequently read the secrets during daily regression runs.

We do not require any compute resources such as Virtual Machines, App Services, or Databases.

While exploring the Azure portal, we noticed that after the free trial expires, Azure requires moving to a Pay-As-You-Go subscription, and even the Basic support plan (which is included) requires adding a credit card.

We would appreciate clarification on the following:

1. Is a Pay-As-You-Go subscription mandatory for this use case after the free trial expires?
2. Does adding a credit card for the Basic support plan result in any recurring subscription or support charges, or is it only required for billing verification?
3. What would be the approximate monthly cost for our expected usage, considering that we only require:
   • One Azure Key Vault
   • Storage of a small number of secrets
   • Daily read access by Azure DevOps automation
   • No other Azure resources
4. Are there any additional charges associated with creating and using an Azure Resource Manager (ARM) Service Connection from Azure DevOps?

Thank you.

Answer 1

Hi Priyanka,

Answers to your questions below:

Q1: Is a Pay-As-You-Go subscription mandatory for this use case after the free trial expires?

A: Yes. If you don't upgrade your subscription to Pay-As-You-Go after 30 days it will be automatically disabled.

Q2: Does adding a credit card for the Basic support plan result in any recurring subscription or support charges, or is it only required for billing verification?

A: Basic support is free. Credit card is charged if you incur any charges. For example, if during the remaining 11 months after initial 30 days you use Key Vault more than what is included in Free services, your credit card will be charged.

Q3: What would be the approximate monthly cost for our expected usage, considering that we only require:

• One Azure Key Vault
• Storage of a small number of secrets
• Daily read access by Azure DevOps automation
• No other Azure resources

A: Assuming you use Standard SKU Key Vault, your cost will depend on how many transactions you have each month. For example, each time you read a secret, that counts as a transaction. You are charged per 10,000 transactions. Other transactions related to secrets are create, update, list. Please check Azure Key Vault pricing page for the cost per 10,000 transactions for the region where you will have your key vault:

https://azure.microsoft.com/en-us/pricing/details/key-vault/

Note that during the 12 month period from when you created your Azure Free subscription a certain amount (10,000) of Azure Key Vault transactions are included each month. If you stay below the included number of transactions there is no charge. After the 12 month period you will be charged for all transactions.

You may monitor your free services usage by navigating to your subscription in the portal. Please see article below for details:

Check usage of free services included with your Azure free account

https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/check-free-service-usage

Q4: Are there any additional charges associated with creating and using an Azure Resource Manager (ARM) Service Connection from Azure DevOps?

A: No.

Please click Accept Answer and upvote if the above was helpful. Thanks.

-TP

Answer 2

Hi ,

Thanks for reaching out to Microsoft Q&A.

Based on the scenario you've described (a single azure Key Vault used to store a small number of secrets that are read by Azure DevOps pipelines), here are the answers to your questions:

1. Is a PAYG subscription required after the free trial expires?

Yes. Once the Azure Free Trial subscription expires, you'll need an active Azure subscription (such as Pay-As-You-Go) to continue using Azure Key Vault and other Azure resources. Azure Key Vault is billed as an Azure resource and therefore requires an active subscription. 

2. Does adding a credit card for the Basic support plan result in support charges?

No. The Basic support plan does not have a separate recurring support fee. A payment method is required to create and maintain a Pay-As-You-Go subscription, but you are only charged for the Azure services you consume. Simply adding a credit card does not, by itself, create additional support charges. However, normal Azure service usage charges will apply. 

3. What would the monthly cost be for this usage?

For a workload consisting of:

• One Azure Key Vault
• A small number of stored secrets
• Daily secret reads from Azure DevOps pipelines
• No VMs, databases, or other Azure services

the cost is typically very low. Azure Key Vault secret operations are billed per number of transactions, and secret storage itself does not generally represent a significant cost for a small deployment. With only a few daily pipeline reads, monthly charges are often just a small fraction of a dollar, though the exact amount depends on your region and actual number of operations. For the most accurate estimate, use the Azure Pricing Calculator and Key Vault pricing page.

4. Are there any charges for an Azure DevOps ARM Service Connection?

No. Creating and using an Azure Resource Manager (ARM) service connection in Azure DevOps does not incur any additional Azure charges. The service connection is simply an authentication and authorization mechanism that allows Azure DevOps to access Azure resources. You are only billed for the Azure resources and operations performed through that connection.

In summary: For your use case, you'll need an active Azure subscription after the free trial ends, but the ongoing cost of a single Key Vault with light secret usage is typically very low, and there are no additional charges for the ARM service connection itself. Always refer to the official Azure pricing page for current rates in your region.

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.