Share via

not able to change access configuration policy

himani ghildiyal 20 Reputation points
2023-10-19T05:18:01.9833333+00:00

CODE

InsufficientPermissions

MESSAGE

RAW ERROR

Caller is not allowed to change permission model. For more information on how to change the permissions model follow this link: https://go.microsoft.com/fwlink/?linkid=2155160. Details: name=live.com#******@gmail.com; oid=b07e2451-9254-439a-bd94-32c3cebb085b; action=Microsoft.Authorization/roleAssignments/write; resource=/subscriptions/d7dad398-d1ca-4b8d-a1e3-e8bedbbc576f/resourcegroups/ghimani/providers/Microsoft.KeyVault/vaults/connectionstringdb1; decision=NotAllowed;

Azure Key Vault
Azure Key Vault

An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.

Azure Role-based access control
Azure Role-based access control

An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. David MATTON 10 Reputation points
    2024-06-25T12:49:22.81+00:00

    Same error here with Terraform.

    With Terraform and a service principal, I created a Key Vault with Access policy. No problem, everything is OK. I decided to enable rbac, and I have the same error.

    The service principal has "Contributor", "User Access Administrator" roles. But the error is still here.

    Was this answer helpful?

    2 people found this answer helpful.
  2. Vinodh247 42,286 Reputation points MVP Volunteer Moderator
    2023-10-19T06:55:49.2566667+00:00

    Hi himani ghildiyal:

    Thanks for reaching out to Microsoft Q&A.

    You should have Key Vault Data Access Administrator, User Access Administrator or Owner permissions to change access configuration policy. Could you double check that?

    Changing permission model requires 'Microsoft.Authorization/roleAssignments/write' permission, which is part of Owner and User Access Administrator roles. Classic subscription administrator roles like 'Service Administrator' and 'Co-Administrator' are not supported.

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    Was this answer helpful?

    1 person found this answer helpful.
  3. Ashwani Shaw 0 Reputation points
    2026-03-16T18:21:50.5633333+00:00

    Hi vinodh I tried your solution but it did not worked

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.