How to create a new permission in Key Vault

Question

How to create a new permission in Key Vault

Miki Ben-Zeev 0 Microsoft Employee

I created a new Vault and added a few key permissions to users to be able to access the secrets in the vault.

However, I am unable to do it anymore. The Vault create button is disabled.

User's image

I do notice there's probably a KeyVault permission I am missing. If that's the case how to I ask for it?

2 answers

Your answer

Answer 1

JIAN WANG 340

might be the access policy changed or redefined.

check the admin who has more access right than yours.

sepcify if your environment has different subscriptions .

Miki Ben-Zeev 0 Reputation points Microsoft Employee

2023-01-30T21:59:57.5633333+00:00

I found it odd that I created that vault, was able to create permissions for various users and now this capability was revoked.

I'll try reaching out to MSIT admin

Answer 2

JamesTran-MSFT 36,911 Microsoft Employee Moderator

@Miki Ben-Zeev

Thank you for your post!

Error Message:

"Microsoft.KeyVault/vaults/write" permission is required to add or edit access policies.

From your error message and post it looks like you're trying to create a new Key Vault Access Policy and are running into a permissions issue. I found a similar issue, and if you recently moved your Key Vault to a new Azure tenant, you'll have to update the Tenant ID.

Update tenant ID in a key vault:

Select-AzSubscription -SubscriptionId <your-subscriptionId>                # Select your Azure Subscription
$vaultResourceId = (Get-AzKeyVault -VaultName myvault).ResourceId          # Get your key vault's Resource ID 
$vault = Get-AzResource -ResourceId $vaultResourceId -ExpandProperties     # Get the properties for your key vault
$vault.Properties.TenantId = (Get-AzContext).Tenant.TenantId               # Change the Tenant that your key vault resides in
$vault.Properties.AccessPolicies = @()                                     # Access policies can be updated with real
                                                                           # applications/users/rights so that it does not need to be                             # done after this whole activity. Here we are not setting 
                                                                           # any access policies. 
Set-AzResource -ResourceId $vaultResourceId -Properties $vault.Properties  # Modifies the key vault's properties.

Clear-AzContext                                                            #Clear the context from PowerShell
Connect-AzAccount                                                          #Log in again to confirm you have the correct tenant id

If your Vault isn't in a new Azure tenant, how long after you created the Vault did you run into this permissions issue?
Can you share what RBAC role you're assigned to (i.e. Owner or Contributor) when it comes to your Key Vault?

I hope this helps!

If you have any other questions, please let me know.

Miki Ben-Zeev 0 Reputation points Microsoft Employee

2023-02-06T18:29:08.94+00:00

Hi,

This is a new Vault, and not a one that was moved from another Azure tenant.

In fact I was able to create a new Key Vault access policy for a couple of users until this capability was revoked.

Here is my access configuration, it's not RBAC. Maybe this has something to do with that?
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2023-02-06T23:16:40.3466667+00:00
@Miki Ben-Zeev

Thank you for following up on this!

To gain a better understanding of your issue:

You're able to create a new Key Vault and add Access Policies, but this capability eventually gets revoked.

When you run into the Access Policy permission issue, is this usually happening after a set amount of time (i.e., 1hr) or after a certain number of users are granted access to your vault via the access policies?

Are you the owner of the Azure Subscription or is this a work owned Azure Subscription?

Is your permission(s) to add access policies getting revoked on all Key Vaults that you're working on?

If you'd like our support team to take a closer look into your issue, please let me know.

Thank you for your time and patience throughout this issue.
Miki Ben-Zeev 0 Reputation points Microsoft Employee

2023-02-07T16:46:30.33+00:00

Hi James,
Here are my answers to your question

The access policy permission issue happened only once so I can't really tell if it's the amount of users I added (only 2 besides me) or the amount of time (about 1 day) after I created the key vault. I assume it's the amount of time since adding 2 users doesn't seem like the bar to revoke permissions...

I am not the owner of the subscription. The subscription is BIA_SF_Stage0_Test1

My permission was revoked only on the new key vault I created

I hope it helps
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2023-02-08T23:16:14.3733333+00:00
@Miki Ben-Zeev

Thank you for following up on this!

Since you're running into this Access Policy permission issue after a certain amount of time (~1 day), I believe your permissions being revoked could be related to an Azure Policy being run on your subscription, especially if this is a work-related Subscription.

Can you see if an Azure Policy is being run on your subscription that could be removing your user's permissions after a certain amount of time?

For example, within my internal subscription, I'm able to navigate to the Subscription, go to the Activity Log, filter by Resource Group, Event initiated by, and Resource, to see if any Subscription Management event was initiated.

Since you're internal, I'd also recommend working closer with our Key Vault Support Engineers, so they can take a closer look into your environment to confirm if this is related to an Azure Policy.

I hope this helps! If you have any other questions, please let me know.
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2023-02-09T23:42:29.9966667+00:00
@Miki Ben-Zeev

I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

I did some testing within my tenant, and you can also check your Activity Logs directly from your Key Vault to see what event/operation removed your user's permission.

From your Key Vault, select Activity log.

Filter for the specific timespan where you lost your Microsoft.KeyVault/vaults/write permission.

Open the specific operation and select the Change history tab.

From the Change history tab, open the hyperlink to see some more info.

I hope this helps! If you have any other questions, please let me know.
Miki Ben-Zeev 0 Reputation points Microsoft Employee

2023-02-13T20:08:00.0333333+00:00

Hi James,

I looked at the activity log and I don't see any event that suggests I wasn't the one initiated it...

Share via

How to create a new permission in Key Vault

2 answers

Your answer