Problem with configuring CMK encryption of a storage Account with a user-assigned identity

Question

Hi,

I have an issue with the creation of an encrypted storage account using a CMK and a user-assigned identity. the steps that I have done are:

• create an azure key vault
• create a key
• create a user-assigned managed identity
• add a role assignement to the key vault, to allow the managed identity to read the keys of the key vault
• configure the storage account encryption tab by indicating that the encryption is customer-managed Key, tke created key vault, the key and the managed identity.

and I get this Error Message.

any help??

the last one is this:

Answer 1

@new User ,

Thank you for posting your query on Microsoft Q&A, from above error ""The operation failed because of authentication issue on Key Vault" seems like we need to validate the following:

• You must create the user-assigned identity before you configure customer-managed keys.
• The user-assigned managed identity must have permissions to access the key in the key vault. Assign the Key Vault Crypto Service Encryption User role to the user-assigned managed identity with key vault scope to grant these permissions.
• Firewall setting of the Key Vault.

Please do let me know if above conditions validated or if you have any queries in the comments section.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.