Applications resolve the current version at runtime and never copy a secret into configuration, so rotation is an operation on the vault rather than a release.
Dual-version rollover: the new version goes live while the old stays enabled, then the old is disabled and later purged. That removes the restart and the outage window that make teams avoid rotating.
Certificates renew 60 days before expiry. An expiry-driven incident is a scheduling failure, and the schedule is automated because humans do not win against calendars.
Vault controls
RBAC data plane rather than access policies, so vault permissions are reviewable with the same tooling as every other Azure role assignment.
Soft delete and purge protection on every vault, private endpoints in production, and diagnostic logging of every data-plane operation.
One vault per environment per landing zone class, 18 in total. A single shared vault makes least privilege impossible; a vault per application makes operations impossible.
Risks
A secret whose consumer caches it beyond its rotation window fails after the old version is disabled. The 24-hour gap between disable and purge exists to catch exactly this.
Bulk secret reads by an unusual principal are detected (view 22) but not blocked, because a legitimate deployment can look identical.
Managed HSM has a distinct recovery model with a security-domain key held offline. Losing it is unrecoverable, so its custody is part of the break-glass procedure in view 26.
