Assign a Key Vault access policy

  • Article

A Key Vault access policy determines whether a given security principal, namely a user, application or user group, can perform different operations on Key Vault secrets, keys, and certificates. You can assign access policies using the Azure portal, the Azure CLI (this article), or Azure PowerShell.

Key vault supports up to 1024 access policy entries, with each entry granting a distinct set of permissions to a particular security principal. Because of this limitation, we recommend assigning access policies to groups of users, where possible, rather than individual users. Using groups makes it much easier to manage permissions for multiple people in your organization. For more information, see Manage app and resource access using Azure Active Directory groups

For full details on Key Vault access control, see Azure Key Vault security features: Identity and access management.

For more information on creating groups in Microsoft Entra ID using the Azure CLI, see az ad group create and az ad group member add.

Configure the Azure CLI and sign in

  1. To run Azure CLI commands locally, install the Azure CLI.

  2. Local CLI only: sign in to Azure using az login:

    az cloud set -n AzureChinaCloud
az login

    The az login command opens a browser window to gather credentials if needed.

Acquire the object ID

Determine the object ID of the application, group, or user to which you want to assign the access policy:

  • Applications and other service principals: use the az ad sp list command to retrieve your service principals. Examine the output of the command to determine the object ID of the security principal to which you want to assign the access policy.

    az ad sp list --show-mine

  • Groups: use the az ad group list command, filtering the results with the --display-name parameter:

    az ad group list --display-name <search-string>

  • Users: use the az ad user show command, passing the user's email address in the --id parameter:

    az ad user show --id <email-address-of-user>

Assign the access policy

Use the az keyvault set-policy command to assign the desired permissions:

az keyvault set-policy --name myKeyVault --object-id <object-id> --secret-permissions <secret-permissions> --key-permissions <key-permissions> --certificate-permissions <certificate-permissions>

Replace <object-id> with the object ID of your security principal.

You need only include --secret-permissions, --key-permissions, and --certificate-permissions when assigning permissions to those particular types. The allowable values for <secret-permissions>, <key-permissions>, and <certificate-permissions> are given in the az keyvault set-policy documentation.

Next steps