Comment ajouter le certificat dans le keyvault

Question

Save Key Vault Settings

Failed to link certificate with the selected Key Vault. Check below errors for more detail.: Failed to assign App Service Certificate to the Key Vault. Caller is not authorized to perform action on resource. If role assignments, deny assignments or role definitions were changed recently, please observe propagation time. Caller: name=AzureAppService;appid=f3c21649-0979-4721-ac85-b0216b2cf413;oid=c2de8699-3bf8-44d3-bab2-2f76067daa2f;iss=https://sts.windows.net/af8f8a64-7ade-4f43-9108-f1dee88e6346/ Action: 'Microsoft.KeyVault/vaults/secrets/setSecret/action' Resource: '/subscriptions/12dca1a0-fe5b-4841-93db-04a5b58b6085/resourcegroups/prd-itaneo/providers/microsoft.keyvault/vaults/prd-itaneo/secrets/asc-ac-35935e60-c39f-418f-b3fe-6cc0861e5711' Assignment: (not found) DenyAssignmentId: null DecisionReason: null Vault: prd-itaneo;location=francecentral .

Answer 1

Hello Jérôme Piquot,

You are receiving this error because the required RBAC role has not been assigned to the Microsoft Azure App Service resource provider.

To allow the App Service to read the certificate from Key Vault, you need to authorize the App Service by assigning it the “Key Vault Certificates User” role. Once this role is assigned, the Key Vault will grant the App Service permission to read the certificate secret.

Please follow the steps below to resolve the issue:

Retrieve the Object ID of Microsoft Azure App Service:

• Sign in to the Azure portal.
• Navigate to Microsoft Entra ID > Enterprise applications.
• Remove the filter “Application type = Enterprise applications”.
• Search for “Microsoft Azure App Service”.
• Copy the Object ID shown for this application.

Note: The Object ID is unique to each tenant, although the App ID remains the same across all tenants.

Assign the Key Vault Certificates User role:

• Go to your Key Vault resource.
• Select Access control (IAM) > + Add > Add role assignment.
• Search for the role “Key Vault Certificates User” and click Next.
• Under the Members tab, select + Select members and paste the Object ID you copied earlier.
• Select the displayed application, then click Select > Review + Assign.

After the role assignment, the Microsoft Azure App Service will have the necessary permissions to use the Key Vault certificate.