← cd ~/compare
// compare · azure roles
Key Vault Administrator vs Key Vault Secrets Officer
Two Azure built-in roles that are often confused, compared permission by permission.
In short: Key Vault Administrator has 10 actions, 1 data actions. Key Vault Secrets Officer has 10 actions, 1 data actions. Assign the one with less access that still covers the job.
| Key Vault Administrator | Key Vault Secrets Officer | |
|---|---|---|
| What Microsoft says | Perform all data plane operations on a key vault and all objects in it, including certificates, keys, and secrets. Cannot manage key vault resources or manage role assignments. Only works for key vaults that use the 'Azure role-based access control' permission model. | Perform any action on the secrets of a key vault, except manage permissions. Only works for key vaults that use the 'Azure role-based access control' permission model. |
| Size | 10 actions, 1 data actions | 10 actions, 1 data actions |
Permissions only Key Vault Administrator lists (0)
None.
Permissions only Key Vault Secrets Officer lists (0)
None.
Azure roles use wildcards such as *, and NotActions take permissions away, so a role can cover an action without listing it. Check the role pages for the full picture.
Key Vault Administrator explained Key Vault Secrets Officer explained