Web App add key vault certificate access error while identity has Key Vault Secrets User permission

Eric Fitskie 91 Reputation points

I have an Azure App Service with custom domain. The certificate for this custom domain is stored in Key Vault.

The web app has set it's identity on and has "Key Vault Secrets User" permission on the key vault. This key vault access configuration is set to "Azure role-based access control (recommended)"

When adding the certificate to the Web App I'm able to select te key vault and certificate. Also the Validate action succeed.

When I click the Add button i got an access error: "The service does not have access to '

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
893 questions
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
5,655 questions
{count} votes

Accepted answer
  1. Akshay-MSFT 9,941 Reputation points Microsoft Employee

    @Eric Fitskie

    Thank you for sharing the information. From above description and error I was able to reproduce the issue in my lab too. With reader role I was able to view certificate but was not able to Add it.

    User's image

    By default, the App Service resource provider doesn't have access to your key vault. To use a key vault for a certificate deployment, you must authorize read access for the resource provider to the key vault. Currently, a Key Vault certificate supports only the Key Vault access policy, not RBAC model.

    User's image

    The above statement is in ref to Azure App services. Also as per Provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control

    User's image


    To use RBAC, instead of assigning the newly created Azure App Service, you should assign Key Vault Secrets User role to global Microsoft Azure App service

    Once followed I was able to import the cert to my App Service from Key Vault:
    User's image

    User's image

    Do let me know if you have any further queries.


    Akshay Kaushik,

    Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

    2 people found this answer helpful.

0 additional answers

Sort by: Most helpful