Azure Key Vault RBAC Least Privilege Roles for Secrets and Management
Short answer
App1 should be assigned the Key Vault Secrets User role to retrieve secrets. User1 should be assigned the Contributor role to manage settings without reading secret values.
Question
You have an Azure key vault named KV1 that uses role-based access control (RBAC) for data plane authorization.
You have a user named User1 and an Azure App Service web app named App1 that has a system-assigned managed identity.
You need to configure authorization to meet the following requirements:
App1 must be able to retrieve secrets from KV1.
User1 must manage the KV1 settings without accessing secret values.
The solution must follow the principle of least privilege.
Which role should you assign to each identity for KV1? To answer, drag the appropriate roles to the correct identities. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Key Takeaways
The trap is confusing management plane permissions (Contributor) with data plane permissions; Contributors can manage vault settings but do not automatically get secret read access.
Learn how to assign Key Vault Secrets User and Contributor roles in Azure RBAC to secure app secrets and user management access with least privilege principles.
Common mistake: Learners often assign 'Key Vault Administrator' to User1, which grants excessive privileges including secret management, violating the least privilege constraint.
Expert Analysis
To satisfy the principle of least privilege, we must distinguish between management plane and data plane access within Azure Key Vault.
App1 (System-Assigned Managed Identity)
App1 requires the ability to retrieve secret values. This is a data plane operation. The Key Vault Secrets User role grants the specific permission Microsoft.KeyVault/vaults/secrets/readSecret/action. This allows the managed identity to read secret contents without having any control over the vault's configuration or other secrets. Assigning a broader role like Contributor would violate least privilege by granting unnecessary management capabilities.
User1 (Human User)
User1 needs to manage KV1 settings but must not access secret values. Managing settings involves operations on the vault resource itself (management plane), such as updating properties, configuring network rules, or managing access policies. The Contributor role provides full access to manage all resources in the scope, including the Key Vault settings. Crucially, Contributor does not inherently grant the readSecret data plane action unless explicitly assigned via Key Vault-specific roles. Therefore, assigning Contributor allows User1 to perform administrative tasks while keeping them out of the secret retrieval path, adhering to the requirement to avoid accessing secret values.
The drag-and-drop mapping is:
- App1 → Key Vault Secrets User
- User1 → Contributor
Official Reference
https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli
This link opens the official vendor documentation in a new tab.
Exam Strategy
When dealing with Azure RBAC questions, always separate 'Management Plane' (resource configuration) from 'Data Plane' (resource content). For Key Vault, remember that 'Contributor' manages the vault object but doesn't read its secrets, while 'Secrets User' reads secrets but can't change the vault structure.
Frequently Asked Questions
Can Contributor role read Key Vault secrets?
Why not use Key Vault Secrets Officer for App1?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
Eltooth 👍 7App1 (Key Vault Secrets User): This role allows the identity to read secret contents and metadata (Microsoft.KeyVault/vaults/secrets/readSecret/action). It grants only the data plane access needed to retrieve secrets without allowing any management of the Key Vault itself. User1 (Contributor): This management plane role allows the user to manage the Key Vault settings, access policies, and network rules (Microsoft.KeyVault/vaults/*). Crucially, because KV1 uses Azure RBAC for data plane authorization, the Contributor role does not grant permissions to read secret values, fully satisfying the requirement.
-
changck 👍 1Key Vault Secrets Officer is more higher privilege than key vault secret user hence it is wrong. Key vault secret user is the correct answer for App1.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →