← cd ~/compare
// compare · azure roles
Key Vault Secrets User vs Key Vault Secrets Officer
Two Azure built-in roles that are often confused, compared permission by permission.
In short: Key Vault Secrets User has 0 actions, 2 data actions. Key Vault Secrets Officer has 10 actions, 1 data actions. Assign the one with less access that still covers the job.
| Detail | Key Vault Secrets User | Key Vault Secrets Officer |
|---|---|---|
| What Microsoft says | Read secret contents. Only works for key vaults that use the 'Azure role-based access control' permission model. | Perform any action on the secrets of a key vault, except manage permissions. Only works for key vaults that use the 'Azure role-based access control' permission model. |
| Size | 0 actions, 2 data actions | 10 actions, 1 data actions |
Permissions only Key Vault Secrets User lists (0)
None.
Permissions only Key Vault Secrets Officer lists (10)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*Microsoft.KeyVault/checkNameAvailability/readMicrosoft.KeyVault/deletedVaults/readMicrosoft.KeyVault/locations/*/readMicrosoft.KeyVault/vaults/*/readMicrosoft.KeyVault/operations/read
Azure roles use wildcards such as *, and NotActions take permissions away, so a role can cover an action without listing it. Check the role pages for the full picture.
Key Vault Secrets User explained Key Vault Secrets Officer explained
Spotted something out of date or wrong? Tell us and we'll fix it.