Transition Azure Key Vaults to Azure RBAC

Question

Transition Azure Key Vaults to Azure RBAC

Stefan Geiger 66

Hello

We are in the process of migrating the permission model for all Azure Key Vaults from ‘Access Policies’ to ‘Azure role-based access control’.

In one of the Key Vault, we have specified the "Microsoft Azure App Service" application in the access policy.

User's image

Is there a corresponding mapping/user in RBAC for the “Microsoft Azure App Service” application, or do I need to specify the managed identity directly for each App Service (Web Apps) ?

Thanks

0 comments

Answer accepted by question author

Marcin Policht 107.3K MVP Volunteer Moderator

Yep - you can assign roles to it directly. Whether you should use it or individual managed identities depends entirely on how your apps interact with the Key Vault.

The distinction is between App Service platform access and application-code access. For App Service platform features, such as importing or synchronizing an SSL/TLS certificate from Key Vault into an App Service, the identity is the Microsoft Azure App Service enterprise application/service principal, rather than the managed identity of each individual Web App. In this scenario, you can create an RBAC assignment on the Key Vault under Access control (IAM) and assign Microsoft Azure App Service the appropriate role, such as Key Vault Secrets User when the platform needs to retrieve the certificate's private-key material, or Key Vault Certificate User when certificate access is sufficient. You do not need to create a separate managed-identity assignment for every Web App solely for this platform functionality.

For application-code access, however, the Microsoft Azure App Service identity is not the identity used by your application to authenticate to Key Vault. If C#, Node.js, or other application code running in the Web App uses the Azure SDK, SecretClient, DefaultAzureCredential, or similar functionality to retrieve secrets at runtime, the Web App should have a system-assigned or user-assigned managed identity. That specific managed identity should then be assigned the appropriate RBAC role on the Key Vault, such as Key Vault Secrets User for reading secret values. This provides access at the individual Web App level and follows least-privilege principles.

So you should not simply replace every Microsoft Azure App Service access policy with the managed identity of each Web App. If the existing access policy was there for an App Service platform feature, such as certificate integration, retain the equivalent Microsoft Azure App Service service-principal access through RBAC. If the access was for application code accessing Key Vault, replace it with an RBAC assignment to the Web App's managed identity.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Stefan Geiger 66 Reputation points

2026-09-11T13:54:45.2433333+00:00

For App Service platform features, such as importing or synchronizing an SSL/TLS certificate from Key Vault into an App Service, the identity is the Microsoft Azure App Service enterprise application/service principal, rather than the managed identity of each individual Web App. In this scenario, you can create an RBAC assignment on the Key Vault under Access control (IAM) and assign Microsoft Azure App Service the appropriate

That solved my problem :)

Thank you very much for your help.

1 additional answer

Your answer

Stefan Geiger 66 Reputation points

2026-09-11T13:54:45.2433333+00:00

For App Service platform features, such as importing or synchronizing an SSL/TLS certificate from Key Vault into an App Service, the identity is the Microsoft Azure App Service enterprise application/service principal, rather than the managed identity of each individual Web App. In this scenario, you can create an RBAC assignment on the Key Vault under Access control (IAM) and assign Microsoft Azure App Service the appropriate

That solved my problem :)

Thank you very much for your help.

Answer 1

Yes. In Azure RBAC, access is granted to security principals such as users, groups, service principals, and managed identities.

For migration, create Azure RBAC role assignments for each security principal that currently has an access policy. That means the equivalent in RBAC is not an access-policy-style entry, but a role assignment to the relevant identity.

For App Service access to Key Vault, the recommended approach is to use a managed identity for the app and assign the required Key Vault RBAC role to that identity. The Visual Studio Key Vault guidance also recommends creating a managed identity to manage Key Vault access for the app.

Use Key Vault Secrets User, Key Vault Secrets Officer, Key Vault Certificate User, or another appropriate built-in Key Vault role based on what the app actually needs. In the Azure portal:

Open the key vault.
Select Access control (IAM).
Select Add > Add role assignment.
Choose the appropriate Key Vault role.
Select the app's managed identity or other service principal.
Select Review + assign.

Important: switching the vault to the Azure RBAC permission model invalidates all access policy permissions. Assign the equivalent RBAC roles before changing the permission model, or outages can occur.