Microsoft Azure function error inside Visual Studio : - "The user, group or application does not have certificates get permission on key vault"

Question

I am developing an azure function (based on .net 6.0) using Visual Studio 2022. Here what i did: -

• I created an Azure Active Directory App >> i upload self-signed certificate inside it: -

• I created an Azure Key Vault >> I uploaded the certificate inside it.

• the inside Visual Studio 20222 >> i created a new Azure Function >> i added the following code: -

using System;
using Azure.Security.KeyVault.Certificates;
using Azure.Identity;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Host;
using Microsoft.Extensions.Logging;
using Microsoft.Identity.Client;
using System.Threading.Tasks;
using Microsoft.SharePoint.Client;

namespace FunctionApp200
{
    public class Function1
    {
        [FunctionName("Function1")]
        public async Task Run([TimerTrigger("0 */5 * * * *")]TimerInfo myTimer, ILogger log)
        {
            log.LogInformation($"C# Timer trigger function executed at: {DateTime.Now}");
            var certClient = new CertificateClient(new
Uri("https://mycerttest123.vault.azure.net/"), new DefaultAzureCredential());

            // download the certificate based on the name
            var cert = certClient.DownloadCertificate("MyCertTest123");

            // use the certificate in ConfidentialClientApplicationBuilder

            var confClientApp = ConfidentialClientApplicationBuilder.Create("My Azure AD app client ID")
                        .WithCertificate(cert)
                        .WithAuthority(new Uri("https://login.microsoftonline.com/My Azure AS App Tenant ID/v2.0/"))
                        .Build();

            AuthenticationResult result = await confClientApp.AcquireTokenForClient(new[] { $"https://****.sharepoint.com/.default" })
                          .ExecuteAsync();
            var token = result.AccessToken;

            // use the token to authenticate the request from CSOM 
            var context = new ClientContext(new Uri("https://****.sharepoint.com"));

            context.ExecutingWebRequest += (s, e) =>
            {
                e.WebRequestExecutor.RequestHeaders["Authorization"] = "Bearer " + token;
            };
        }
    }
}

but i got this error on var cert = certClient.DownloadCertificate("MyCertTest123"); when the function start executing: -

`[2023-02-12T23:00:14.903Z] Executed 'Function1' (Failed, Id=****, Duration=14868ms)

[2023-02-12T23:00:14.904Z] System.Private.CoreLib: Exception while executing function: Function1. Azure.Security.KeyVault.Certificates: The user, group or application 'appid=8***;oid=***;iss=https://sts.windows.net//' does not have certificates get permission on key vault 'MyCertTest123;location=eastus'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287

[2023-02-12T23:00:14.904Z] Status: 403 (Forbidden) [2023-02-12T23:00:14.905Z] ErrorCode: Forbidden [2023-02-12T23:00:14.905Z] [2023-02-12T23:00:14.905Z] Content: [2023-02-12T23:00:14.906Z] {"error":{"code":"Forbidden","message":"The user, group or application 'appid=8`

Answer 1

@john john

Thank you for your post and I apologize for the delayed response!

Error Message:
Forbidden: The user, group or application 'appid=...6e460a02d1f1'.... does not have certificates get permission on key vault.

From your error message, it looks like your application with App ID ending in 6e460a02d1f1, doesn't have the Certificates GET permission on your Key Vault. To resolve this error, you'll have to Assign an access policy:

1. Navigate to your Key Vault (MyCertTest123)
2. Select Access policies, then select Create.
3. Select the permissions you want under Key permissions, Secret permissions, and Certificate permissions (GET).
4. Under the Principal selection pane, enter the App ID or Object ID from your error message in the search field and select the appropriate result.
5. Review the access policy changes, select Create to save the access policy.

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

Additional Link - HTTP 403: Insufficient Permissions