Key Vault Expiry Monitor - 2026 Pricing, Features, Reviews & Alternatives

Azure Key Vault doesn't reliably tell you when something inside it is about to expire. Certificate near-expiry events fire exactly once, roughly 30 days before the deadline; secrets and keys emit no near-expiry events at all. Vigil closes that gap by deploying a Function App directly into your own Azure subscription — via a single ARM template — that scans every vault you add on a schedule (daily on lower tiers, hourly on the top tier) and sends email alerts through Azure Communication Services at configurable thresholds (default 90, 60, and 30 days out).

A dashboard, also deployed into your own subscription on Azure Static Web Apps, shows every vault, every resource, and days-until-expiry in one place, and flags resources with no expiry date set — a common security gap. Optional Daily Digest Mode rolls alerts into one summary email. Webhook delivery (Microsoft Teams, Slack, PagerDuty, or any HTTP endpoint) is available from the Team plan up, and per-vault alert routing — so specific vaults notify specific teams — is available from the Business plan up.

Security model: Vigil authenticates to Key Vault using a User-Assigned Managed Identity granted the built-in Key Vault Reader role per vault, the same pattern Microsoft recommends for production workloads. No API key, password, or service-principal secret is ever stored, and Vigil never reads the actual secret, key, or certificate values — only their expiry metadata.

Free ($0/month) covers 1 vault on daily scans. Starter ($49/month) covers 5 vaults with SSO. Team ($99/month) covers 25 vaults and adds webhooks. Business ($249/month) covers 75 vaults, scans every 6 hours, and adds per-vault routing. Enterprise ($600/month) is unlimited vaults, hourly scans, and a dedicated support contact with a 4-hour SLA.