RBAC issue with my KV even as the owner of the sub

Welcome to Microsoft Q&A

Hello Abayomi Ogunbode,

While the Owner role grants you full control over the management plane (creating, deleting, or modifying the Key Vault resource itself), it explicitly does not grant you data-plane permissions to access or manage the secrets, keys, or certificates stored inside the vault.

Because your new Key Vault is configured to use the Azure RBAC permission model (indicated by the specific error message), you must explicitly assign yourself a Key Vault data-plane role to perform the Microsoft.KeyVault/vaults/certificates/import/action action.

1. Navigate to your Key Vault (qasualityKV) in the Azure Portal.
2. Select Access control (IAM) from the left-hand menu.
3. Click Add > Add role assignment.
4. Search for and select the Key Vault Administrator role (which grants full data-plane access to keys, secrets, and certificates) or the narrower Key Vault Certificates Officer role.
5. Assign this role directly to your user account (Object ID 19efa332-f28d-4be4-b75a-8f3f6d82f49f).

Please try this let me know if works for you

Note: After assigning the role, Azure RBAC caching means it can take up to 5–10 minutes for the propagation to take effect across the backend. Wait a few minutes before attempting the import again.

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

Hello Abayomi Ogunbode,

This behavior is expected when the Key Vault is using Azure RBAC authorization.

Even though you are Owner at the subscription and Key Vault level, the Owner role only provides management‑plane access (create/delete/configure resources). It does not grant data‑plane permissions to perform actions like certificate import.

From the error:

• Assignment: (not found) confirms that no Key Vault data‑plane RBAC role is assigned for certificate operations.

What you need to do

1. Go to Key Vault → Access control (IAM)
2. Assign one of the following roles to your user at the Key Vault scope:
   • Key Vault Certificates Officer (recommended)
     • or Key Vault Administrator (full access)
     1. Wait 5–10 minutes for RBAC propagation, then retry the operation.

Also make sure the Key Vault Access configuration is set to: Azure role-based access control (RBAC) (Access policies are ignored when RBAC is enabled.)

https://learn.microsoft.com/en-in/azure/key-vault/general/rbac-guide?tabs=azure-cli

If the issue persists after the role assignment and propagation time, please confirm:

• The role assigned
• Scope of the assignment
• Key Vault permission model

Thank you for your reply. The problem is that the KV admin role does not appear, even though I have tried several times in the past.

Thank you for your reply. The problem is that the KV admin role does not appear, even though I have tried several times in the past.