After deleting access policy from Azure Key Vault, the respective app can still access the secret

Question

After I delete an access policy for read access to a secret for an AAD principal, the respective app can still access the secret (via Key Vault reference in application settings). This was all done over the Azure portal. I restarted the app - still has access.

Why can the app still access the secret?

Answer 1

Sorry for the late reply, I checked the azure portal again right now.

In the app configuration, the secrets now show up correctly (after such a long time, I didn't change the configuration since then):

Then, I tested the app - still has access(!).

After that, I restarted the app -> no access anymore.

The questions is then:

Why is access not revoked immediately after removing the access policy? It seems to take hours or even days to come into effect and only an app restart then actually denies access. This seems a potentially significant security risk.

Answer 2

Are you able to show that the access policy is fully removed and specified the ObjectID for that application? You can try running Remove-AzKeyVaultAccessPolicy to ensure that all access is gone. https://learn.microsoft.com/en-us/powershell/module/az.keyvault/remove-azkeyvaultaccesspolicy?view=azps-6.0.0

Also, have you made sure that key vault firewall is configured so that "All networks" is not allowed? https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-diagnostics

Otherwise it may be some token issue. If neither of the above work I will reach out to the feature team to about this.