// roles/azure · security

Key Vault Data Access AdministratorAzure built-in role

Manage access to Azure Key Vault by adding or removing role assignments for the Key Vault Administrator, Key Vault Certificates Officer, Key Vault Crypto Officer, Key Vault Crypto Service Encryption User, Key Vault Crypto User, Key Vault Reader, Key Vault Secrets Officer, or Key Vault Secrets User roles. Includes an ABAC condition to constrain role assignments.

Role ID	`8b54135c-b56d-4d72-a534-26097cfdc8d8`
Category	Security
Actions	9
Data actions	0

Before you assign it

It can give access to others. It allows Microsoft.Authorization/roleAssignments/write, so treat it as a privileged role and assign it through PIM where you can.

What it can do

Permission	What it allows
`Microsoft.Authorization/roleAssignments/write`	Create a role assignment at the specified scope.
`Microsoft.Authorization/roleAssignments/delete`	Delete a role assignment at the specified scope.
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Management/managementGroups/read`	List management groups for the authenticated user.
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.KeyVault/vaults/*/read`	Any read operation on anything under Microsoft.KeyVault/vaults

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Key Vault Data Access Administrator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Key Vault Data Access Administrator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '8b54135c-b56d-4d72-a534-26097cfdc8d8')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8b54135c-b56d-4d72-a534-26097cfdc8d8')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "8b54135c-b56d-4d72-a534-26097cfdc8d8"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other security roles

App Compliance Automation Reader · 1 permission
Key Vault Crypto Service Release User · 1 permission
Security Assessment Contributor · 1 permission
Attestation Reader · 2 permissions
Key Vault Secrets User · 2 permissions
Attestation Contributor · 3 permissions
Locks Contributor · 3 permissions
Key Vault Certificate User · 4 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles