Access Policy not available

Question

Access policies are not available, when i tried to change the access configuration to "Vault access policy" i am getting error Insufficient permission where as i have been asses as Key Vault administrator role. Can you help on to assign the access policies

Answer 1

Hi

Key Vault Administrator and other built-in RBAC roles operate at Data Plane level for accessing and managing Key Vault data (certificates/keys/secrets):

https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli#azure-built-in-roles-for-key-vault-data-plane-operations?wt.mc_id=AZ-MVP-5005255

For Management Plane access, you can either grant Owner/Contributor access to the Subscription/Management Group/Resource Group that the Key Vault sits in, or else you'd need to create a Custom Role to achieve this (this would be best practice).

Sample Custom Role can be created using the code below:

# Define the custom role JSON
$roleDefinition = '{
    "Name": "KeyVaultManagementRole",
    "IsCustom": true,
    "Description": "Allows management of Azure Key Vault Management plane",
    "Actions": [
        "Microsoft.KeyVault/vaults/*"
    ],
    "NotActions": [],
    "AssignableScopes": ["/subscriptions/{subscriptionId}"]
}'

# Create the custom role
New-AzRoleDefinition -InputObject (ConvertFrom-Json $roleDefinition)

Hope this helps,

Thanks

Michael Durkan

• If the reply was helpful please upvote and/or accept as answer as this helps others in the community with similar questions. Thanks!