Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
Cant import Certificates from Key Store to Web App
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 74%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPV%3C/text%3E%3C/svg%3E)
Pile Vic
0
Reputation points
Cannot import web app from Key Vault.
Failed to import key vault certificate: https://smppileopskeyvault.vault.azure.net/certificates/pileops. Error: The service does not have access to '/subscriptions/xxxxxxxxxxxx/resourcegroups/pilingops_rg/providers/microsoft.keyvault/vaults/smppileopskeyvault' Key Vault. Please make sure that you have granted necessary permissions to the service to perform the request operation.
Failed to import key vault certificate: https://smppileopskeyvault.vault.azure.net/certificates/pileops. Error: The service does not have access to '/subscriptions/xxxxxxxxx/resourcegroups/pilingops_rg/providers/microsoft.keyvault/vaults/smppileopskeyvault' Key Vault. Please make sure that you have granted necessary permissions to the service to perform the request operation.
I have spent all day trying to get this to work. Now Microsoft is making me pay for support.
Azure Key Vault
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(220.8, 92%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Sridevi Machavarapu 11,320 Reputation points Microsoft External Staff Moderator2025-12-22T01:18:20+00:00 Hello Pile Vic,
This usually comes up when using RBAC to import a certificate from Azure Key Vault into a Azure App Service.
Even if the Web App’s managed identity has access, the import is handled by the App Service platform. Because of that, Microsoft.Web also needs permission on the Key Vault.
Please check the following:
- In Key Vault → Access control (IAM), add the role Key Vault Certificate User
- Assign it to Microsoft.Web (service principal ID:
abfa0a7c-a6b6-4736-8310-5855508787cd) - Confirm the Web App’s managed identity has Key Vault Certificate User.
- If Key Vault networking is restricted, allow trusted Microsoft services
After this, try the import again from: Web App → TLS/SSL settings → Private Key Certificates (.pfx) → Import from Key Vault
Microsoft documentation for this setup: https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex%2Crbac%2Cazure-cli#import-a-certificate-from-key-vault
You can make use of below Azure CLI command to assign that role:
az role assignment create --role "Key Vault Certificate User" --assignee "abfa0a7c-a6b6-4736-8310-5855508787cd" --scope "/subscriptions/{subscriptionid}/resourcegroups/{resource-group-name}/providers/Microsoft.KeyVault/vaults/{key-vault-name}"Hope this helps! Feel free to reach out for any further queries.
Sign in to comment
Sign in to answer