How Many Key Vaults Is Too Many to Track by Hand?

If you run one Azure Key Vault, you probably don't need Vigil. A single Event Grid subscription and an Azure Monitor alert rule will get you a reasonable warning before a secret expires, and setting that up once isn't a big lift.

The question is what happens at vault number six. Or twenty. Or the point where "our Key Vaults" stopped being something one person could name from memory.

The per-vault model doesn't get harder — it gets more numerous

Each vault still needs its own Event Grid subscription wired up, still gets exactly one 30-day warning per secret that vanishes if nobody sees it, and still has no dashboard tying any of it together. None of that changes as you add vaults. What changes is that you're now maintaining that same manual setup N times, across dev, staging, and production, across however many subscriptions your environments actually live in — and the odds that one of those N setups quietly has a gap goes up with every vault you add.

The failure mode isn't dramatic, which is exactly the problem

Nobody notices a missing Event Grid subscription until the secret it should have been watching actually expires. By then it's not a monitoring gap anymore, it's an incident — a service that stops authenticating, a certificate that suddenly isn't trusted, a webhook that starts failing silently. The teams we hear from aren't the ones who never had monitoring. They're the ones who had it on 18 of their 22 vaults and found out about the other 4 the hard way.

Aggregation, not alerting

This is the actual line Vigil is built around. Azure can already tell you a secret is expiring, one vault at a time, if you've done the setup. What it can't do is show you every vault you own in one place, so a gap in coverage is visible before it becomes an outage instead of after. Vigil auto-discovers vaults across your subscriptions via Azure Resource Graph — nothing to manually register — and gives you one dashboard showing days-until-expiry across all of them, with digest-mode notifications so ten things expiring in the same week shows up as one useful summary, not ten separate emails.

If you're managing a handful of vaults and it still feels manageable by hand, it probably is — the Free tier exists for exactly that case, and there's no reason to pay for aggregation you don't need yet. The point where it stops being manageable isn't a specific number. It's the point where you can't confidently answer "which of our vaults doesn't have expiry monitoring set up" without going and checking.