Azure Key Vault admin role

As explained in Azure Security

Key Vault Administrator is an Azure built-in role that permits all data plane operations on a key vault and its objects.

Key Vault Administrator is an Azure built-in role that can perform every data plane operation on a key vault and its objects, including keys, secrets, and certificates. It is used when configuring Azure Storage with a customer-managed encryption key: the administrator grants a managed identity permission to access that key. section 5.2.2 section 5.1.6

For customer-managed key encryption, the operational relationship is:

• Assign the Key Vault Administrator role within a key vault that uses the Azure RBAC permission model. section 5.2.2
• Grant the Storage account’s user-assigned or system-assigned managed identity at least get, wrapkey, and unwrapkey permissions on the key. section 5.1.6
• Let Azure Storage authenticate through Microsoft Entra ID, wrap its account encryption key, and request unwrapping for encryption and decryption. section 5.1.6

Scope comparison

Key Vault Administrator covers all data plane operations. More focused alternatives include Key Vault Reader for metadata, Key Vault Crypto User for cryptographic operations, and Key Vault Secrets User for reading secret contents. section 5.2.2

Figure 5.1 Azure Storage encryption using a customer-managed key

Trace how Azure Storage uses a customer-managed key in Key Vault to protect its account encryption key. section 5.1.6

How Azure Security covers it

How deep it goes

Defines full object-level access and explains its managed-identity encryption workflow, but does not provide an Azure RBAC assignment command.

Examples

Uses customer-managed Azure Storage encryption and contrasts Administrator with Reader, Crypto User, and Secrets User roles.

What it assumes

Assumes familiarity with Azure Storage, Key Vault, managed identities, and customer-managed keys while identifying required permissions explicitly.

What you can do after

Configure managed-identity access for Azure Storage customer-managed encryption and distinguish broader from narrower Key Vault roles.

How it connects

Connects Azure RBAC, Azure Key Vault, Azure Storage, managed identities, Microsoft Entra ID, and customer-managed keys.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• built-in rolekind of · An Azure built-in role is a predefined role containing a provider-defined set of permissions assignable to identities for managing Azure resources.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.