How does Key Vault auto-rotate a secret connected to a storage account access key?
- A Key Vault generates new storage keys directly
- B A rotation function reads the event (SecretNearExpiry), regenerates the storage key via Azure Storage API, updates Key Vault secret version (correct answer)
- C Automatic; no action required
- D Azure AD rotates storage keys automatically
Shortcut: Key Vault Near-Expiry event triggers an Azure Function rotation job. The function regenerates the storage account key (az storage account keys renew) and stores the new value as a new secret version in Key Vault.