// roles/azure · security

Key Vault Crypto UserAzure built-in role

Perform cryptographic operations using keys. Only works for key vaults that use the 'Azure role-based access control' permission model.

Role ID	`12338af0-0e69-4776-bea7-57ae8d297424`
Category	Security
Actions	0
Data actions	9

Before you assign it

It reaches the data, not just the resource. It has 9 data actions, such as reading blobs, secrets or messages.

What it can do

No control-plane actions.

Data actions

Permission	What it allows
`Microsoft.KeyVault/vaults/keys/read`	List the keys in a specified vault, or read the current version of a specified key.
`Microsoft.KeyVault/vaults/keys/update/action`	Updates the specified attributes associated with the given key.
`Microsoft.KeyVault/vaults/keys/backup/action`	Creates the backup file of a key. The file can used to restore the key in a Key Vault of same subscription. Restrictions may apply.
`Microsoft.KeyVault/vaults/keys/encrypt/action`	Encrypts plaintext with a key. Note that if the key is asymmetric, this operation can be performed by principals with read access.
`Microsoft.KeyVault/vaults/keys/decrypt/action`	Decrypts ciphertext with a key.
`Microsoft.KeyVault/vaults/keys/wrap/action`	Wraps a symmetric key with a Key Vault key. Note that if the Key Vault key is asymmetric, this operation can be performed by principals with read access.
`Microsoft.KeyVault/vaults/keys/unwrap/action`	Unwraps a symmetric key with a Key Vault key.
`Microsoft.KeyVault/vaults/keys/sign/action`	Signs a message digest (hash) with a key.
`Microsoft.KeyVault/vaults/keys/verify/action`	Verifies the signature of a message digest (hash) with a key. Note that if the key is asymmetric, this operation can be performed by principals with read access.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Key Vault Crypto User" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Key Vault Crypto User" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '12338af0-0e69-4776-bea7-57ae8d297424')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "12338af0-0e69-4776-bea7-57ae8d297424"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other security roles

App Compliance Automation Reader · 1 permission
Key Vault Crypto Service Release User · 1 permission
Security Assessment Contributor · 1 permission
Attestation Reader · 2 permissions
Key Vault Secrets User · 2 permissions
Attestation Contributor · 3 permissions
Locks Contributor · 3 permissions
Key Vault Certificate User · 4 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles