I added a Key Vault access policy for a service principal, but it disappears after creation.

Question

Every time I assign an access policy to a service principal in the Key Vault, it shows as successfully assigned.
kv.png
However, when I refresh the page or navigate away and return to the access policy tab, the service principal is no longer visible. I’ve tried different browsers and even created new Key Vaults and service principals, but the issue persists.

gone.png

Answer 1

Hello @Altamash Jawed

The most likely cause is that the Key Vault is configured to use Azure Role-Based Access Control (Azure RBAC). When RBAC is enabled, the Key Vault ignores the traditional access policies. Either switch to using Azure RBAC roles for permissions or switch the Key Vault back to using Vault access policies in the Networking configuration.

• Key Vault can only use either Azure RBAC or Vault access policies, not both simultaneously.
• Always verify the Access Model in the Key Vault's Networking configuration.
• Use Azure CLI or PowerShell to confirm the actual Key Vault configuration, bypassing potential portal caching issues.
• If the Access model is set to "Azure role-based access control": The Key Vault ignores the access policies. Grant the Service Principal permissions using Azure RBAC roles (e.g., "Key Vault Secrets Officer") at the Key Vault scope.
• If the Access model is set to "Vault access policy": The policies should be visible and active. If they are still disappearing, proceed to Step 1.

Step 1: Verify Portal Caching and Synchronization (If using Vault Access Policy Model)

If the Access Model is set to "Vault access policy," perform a hard refresh of the browser (Ctrl+F5 or Cmd+Shift+R). Use the Azure CLI to confirm the actual configuration:

az keyvault show --name <your-key-vault-name> --resource-group <your-resource-group-name> --query 

---

If the Answer is helpful, please click Accept Answer and Up-Vote, so that it can help others in the community looking for help on similar topics.