I am getting an error when trying to import a certificate from Key Vault to App Service

Shaun Blackham (Insight Global LLC) 65 Reputation points Microsoft External Staff
2026-04-28T21:04:10.8166667+00:00

I am an owner of an App Service

I have created a certificate in the associated Key Vault, and I have been trying to upload a certificate(bring your own pfx) from the associated KV to this App Service and I keep getting this error:

 

The service does not have access to '/subscriptions//resourcegroups//providers/microsoft.keyvault/vaults/*' Key Vault. Please make sure that you have granted necessary permissions to the service to perform the request operation.

 

I have added the App Service managedIdentity as a Key Vault Administrator, so it should have access. 

Do you have any advice for me? 

Azure Key Vault
Azure Key Vault

An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.

0 comments
Answer accepted by question author
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator
2026-04-28T21:08:36.2366667+00:00

Hello Shaun Blackham (Insight Global LLC),

The issue is that certificate import from Key Vault does not use the App Service managed identity.

Azure App Service uses the Microsoft Azure App Service (Microsoft.Azure.WebSites) service principal to read the certificate from Key Vault.

Service principal App ID: abfa0a7c-a6b6-4736-8310-5855508787cd

So even if the managed identity has Key Vault Administrator access, the import can still fail if this service principal does not have permission.

Please assign the Key Vault Certificate User role on the Key Vault to this service principal:

az role assignment create --role "Key Vault Certificate User" --assignee "abfa0a7c-a6b6-4736-8310-5855508787cd" --scope "/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.KeyVault/vaults/{key-vault-name}"

After the role is assigned, wait a few minutes and try the import again.

Also verify that the certificate in Key Vault is a valid exportable PFX certificate.

Reference: Install a TLS/SSL Certificate for Your App - Azure App Service | Microsoft Learn

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.