Unable to export SSL Certificate

Question

Microsoft tech support moved a directory to a new subscription.

Since then nothing but problems.

Attempting to access Key Vault puts an error banner at the top of the page: The directory (LiveCo) currently selected differs from this KeyVault's directory. Some actions will be disabled.

Trying to export a SSL Certificate from the key vault gives this error:

The connection to data plane failed. Please refresh and try again. If Private Links are enabled on the vault and the issue persists please follow the steps in the following link https://go.microsoft.com/fwlink/?linkid=2156688 .

I am NOT using private network.

Attempting to follow any Microsoft guidance and I get authorization errors that I am not authorized to perform actions - but I AM IN OWNER ROLE!

Help!

Answer 1

Hi,
is not a role issue and not a private network issue. It is a tenant mismatch issue caused by the directory move. The banner clearly says that the currently selected directory differs from the Key Vault directory. That means the vault still belongs to the original tenant where it was created, while your subscription is now associated with a different tenant. Being Owner on the subscription does not give you data plane access if your identity is not in the tenant that the vault trusts.

Key Vault authorisation happens in two layers. Control plane access is based on subscription RBAC. Data plane access for secrets and certificates is validated against the tenant ID stored in the vault. After a directory migration those two can become misaligned.

To confirm, run az keyvault show --name <vault-name> --query properties.tenantId and compare that tenant ID with the tenant you are currently signed into. If they differ, the only ways forward are to sign into the original tenant and export the certificate from there, or to recreate the vault in the new tenant and restore from backup if you have one. There is no supported method to change the tenant ID of an existing Key Vault.

rgds,

Alex