How to Create a Custom Role for Azure Key Vault That Allows Writing Secrets Without Read Access (RBAC)

Question

I'm trying to implement least privilege access to Azure Key Vault using the RBAC permission model, as recommended by Microsoft.

My objective is to assign an Entra ID group a role that:

• Allows writing or updating secrets (e.g. set operations)
• Allows listing the names of secrets (e.g. list)
• Does not allow reading secret values (get)

This is a common pattern when developers need to store secrets but should not be able to retrieve them later nor retrieve others. I've already read this doc

However there is no built-in Secrets Writer role. The closest built-in role, Key Vault Secrets Officer, allows both read and write (Microsoft.KeyVault/vaults/secrets/*).

The documentation does not explicitly describe which actions are required for write-only access.

What is the minimal set of actions required to create a custom RBAC role that:

• Allows Microsoft.KeyVault/vaults/secrets/set
• Allows Microsoft.KeyVault/vaults/secrets/list
• Blocks Microsoft.KeyVault/vaults/secrets/get

This role would ideally be defined at the subscription scope, but I’m open to restricting it per-Key Vault if necessary.

Thanks in advance.

Answer 1

Hi @Jonathan Lafleur,

Based on your query, here is the summary:

As per the review, you have used the action Microsoft.KeyVault/vaults/secrets/set/action, which triggered an (InvalidActionOrNotAction) error, as the specified action is not supported in Azure’s RBAC model. Explained that access to Key Vault secrets must be configured using DataActions and NotDataActions, since these operations are considered data-plane. Provided a corrected custom role definition that includes DataActions for writing, listing, and reading metadata of secrets, while explicitly excluding secret read access via NotDataActions. Official Microsoft documentation to support the guidance: https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli.Kindly use the below Json file as an example to rephrase your Json file which mostly resolves the issue:

az role definition create --role-definition '{ "Name": "Backup Keys Operator", "Description": "Perform key backup/restore operations", "Actions": [ 
    ], "DataActions": [ "Microsoft.KeyVault/vaults/keys/read ", "Microsoft.KeyVault/vaults/keys/backup/action", "Microsoft.KeyVault/vaults/keys/restore/action" ], "NotDataActions": [ 
   ], "AssignableScopes": ["/subscriptions/{subscriptionId}"] }'

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment".

Answer 2

try creating the following custom role:

{
  "Name": "Key Vault Secrets Writer (No Read)",
  "IsCustom": true,
  "Description": "Allows setting and listing Key Vault secrets without read access.",
  "Actions": [
    "Microsoft.KeyVault/vaults/secrets/set",
    "Microsoft.KeyVault/vaults/secrets/list"
  ],
  "NotActions": [
    "Microsoft.KeyVault/vaults/secrets/get"
  ],
  "AssignableScopes": [
    "/subscriptions/<your-subscription-id>"
    // or more granular scope like:
    // "/subscriptions/<subscription-id>/resourceGroups/<rg-name>/providers/Microsoft.KeyVault/vaults/<vault-name>"
  ]
}

Replace <your-subscription-id> with your actual subscription ID.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin