App service import cert permission error

Question

Hi

I am attempting to get certificates from keyvault to an app service, by default, it lists one certificate from the keyvault which contains multiple certs. I ran this command which provides read permissions for certificates and secrets to Microsoft Azure App Service :
Set-AzKeyVaultAccessPolicy -VaultName '<keyvault>' -ObjectId <object id> -PermissionsToCertificates Get -PermissionsToSecrets Get

The object id is of the application mentioned in https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex#import-a-certificate-from-key-vault .

I still am unable to add rest of the certs from the keyvault, it throws error:

Failed to import key vault certificate: Error: The service does not have access to Key Vault. Please make sure that you have granted necessary permissions to the service to perform the request operation.

Could you help me understand which permission is needed for the service and why is it able to read one cert out of many from the keyvault on service creation?

Answer 1

Hello Anupam Kumar

By default, the App Service resource provider doesn't have access to your key vault. To use a key vault for a certificate deployment, you must authorize read access for the resource provider to the key vault.

Currently, the Azure portal does not allow you to configure an App Service certificate in Key Vault to use the RBAC model. You can, however, use Azure CLI, Azure PowerShell, or an ARM template deployment to perform this configuration. For more information, see Provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control.

Resource provider	Service principal AppId	Key vault secret permissions	Key vault certificate permissions
Microsoft Azure App Service or Microsoft.Azure.WebSites	- abfa0a7c-a6b6-4736-8310-5855508787cd, which is the same for all Azure subscriptions	Get	Get
Microsoft Azure App Service or Microsoft.Azure.WebSites	- abfa0a7c-a6b6-4736-8310-5855508787cd, which is the same for all Azure subscriptions	Get	Get

https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex#authorize-app-service-to-read-from-the-vault