Does Azure Key Vault Send Expiration Warnings? (A Straight Answer)

Short answer: partially, and not in a way you can rely on. Azure Key Vault's warning coverage depends entirely on what's expiring — certificate, secret, or key — and none of the three get the kind of ongoing, dependable notification most teams assume is already happening. Here's exactly what's covered, what isn't, and where that leaves you.

Broken down by resource type

• Certificates: Key Vault does emit a CertificateNearExpiry event via Event Grid — but only once, approximately 30 days before expiration. There's no second warning at 14 days, or 7, or the day of. Miss that single event — a dropped webhook, an Event Grid subscription that was never configured, a notification that lands in an inbox nobody's watching — and there's no further alert before the certificate actually expires.
• Secrets: Key Vault emits a matching SecretNearExpiry event, also once, roughly 30 days out. Same single-shot limitation as certificates — and the same requirement that you've already created an Event Grid subscription for that specific vault before the event is worth anything.
• Keys: Key Vault emits KeyNearExpiry as well, with the timing configurable through a key rotation policy rather than fixed at 30 days — but that policy has to be set up per key, and the event still needs its own Event Grid subscription to go anywhere.
• None of it is wired up by default, for any of the three. Key Vault will let a certificate, secret, or key expire completely silently — no email, no webhook, no portal banner, nothing — unless an Event Grid subscription has been specifically created for that event type, on that vault, with somewhere for the event to actually go.
• The Azure Portal itself: does not proactively surface expiring secrets, keys, or certificates anywhere in its UI unprompted. There's no dashboard, no notification bell, no "3 items expiring soon" banner. You have to know to go look — opening each vault's list and manually checking expiration dates, vault by vault, on some cadence you remember to keep up.

What "wire up Event Grid yourself" actually involves

Closing this gap without a third-party tool means building three separate Event Grid subscriptions per vault — one each for certificates, secrets, and keys — re-done every time a new vault gets added to your environment. It means accepting that most of those events fire exactly once, so there's no second chance if the notification gets missed. And it means building somewhere for the results to actually land — a dashboard, a digest email, some place a human will genuinely look before the expiration date passes, not after.

The honest caveat

Teams already paying for a full observability platform — Datadog or similar, with custom Key Vault integrations already built — may already have this solved, and none of the above is new information to them. This is written for the much larger group of teams running Key Vault in production without that: no custom integration, no dedicated polling job, just the vault itself and whatever expiration coverage they assumed came built in.