Share via

Azure KeyVault left with stale reference in access policies

Tejas Shah 6 Reputation points Microsoft Employee
2020-07-13T18:19:56.037+00:00

I assign an access policy for a managed identity to a keyvault via ARM template. When the identity is deleted, the access policy is NOT removed automatically from the KV and so a stale reference is left behind. Is this expected? Shouldn't the reference get removed when the referencing object gets deleted?

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,160 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,496 Reputation points Microsoft Employee
    2020-07-13T20:39:31.38+00:00

    @TejasShah-0762
    This is expected behavior. As stated within our Managed Identities documentation "Deleting a user assigned identity does not remove it from the VM or resource it was assigned to...". I was able to test this out with a Managed Identity for Azure Resources, namely a VM, and found that this had to be manually deleted also.

    Findings:
    In the below screenshot, I deleted the User Managed Identity from the actual "Managed Identities" page in the Azure Portal. I waited 5 minutes and the Identity was still in the Key Vault. Even after a "refresh" as seen at the top of the screenshot.
    11940-deletedusermngid.jpg

    In this screenshot, I added my VM's system-assigned managed identity, deleted the VM and Resource Group, waited a few minutes to see if the Key Vault would update, and it didn't.
    12051-deletedmngidvm.jpg

    Since this looks to be a "by-design" type of issue, please feel free to submit a feature request using the User voice/General Feedback link.

    Please let me know if you have any other questions.
    Thank you for your time and patience!

    If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.