As you know, Key Vault lets you save secrets, certificates or keys in a secure way to then allows you to use it either with automation or simply as a ‘user vault’.
You also know that access to the Key Vault is managed by assigning access policies, defining who can access and do what.
Well, good news, you can now use Role Based Access Control (RBAC) to set the Key Vault access policies.
With this new capability, you also have new RBAC roles available:
|Key Vault Administrator||Perform all data plane operations on a key vault and all objects in it, including certificates, keys, and secrets. Cannot manage key vault resources or manage role assignments|
|Key Vault Certificates Officer||Perform any action on the certificates of a key vault, except manage permissions|
|Key Vault Crypto Officer||Perform any action on the keys of a key vault, except manage permissions|
|Key Vault Crypto Service Encryption||Read metadata of keys and perform wrap/unwrap operations|
|Key Vault Crypto User||Read metadata of key vaults and its certificates, keys, and secrets. Cannot read sensitive values such as secret contents or key material|
|Key Vault Secrets Officer||Perform any action on the secrets of a key vault, except manage permissions|
|Key Vault Secrets User||Read secret contents|
|Key Vault Contributor||Manage Key Vaults. Do not have access to keys, secrets or certificates|
To start using RBAC to grant access to Key Vault, logon to you Azure portal (https://portal.azure.com/) and access your Key Vault
Then access the Access policies blade to enable the use of RBAC
NOTE switching to RBAC may result of access being lost. You have to plan when you are going to perform the switch to avoid/limit service disruption
Once you have switch to the Azure role-based access control mode and save the change you can now use the Access control (IAM) blade to grant users/groups/service principal/managed identity the appropriate role