A Key Vault access policy authorizes an identity to perform selected data plane operations on secrets, keys, or certificates. It is separate from control plane permissions: managing the vault does not automatically grant access to its stored objects. section 5.2.1 section 5.2.2
Policies specify permissions independently for certificates, keys, and secrets. Azure RBAC is the recommended alternative because it centralizes authorization and separates permission management through Owner and User Access Administrator roles. section 5.2.2
Configure a policy by assigning only the operations the identity requires:
- Restrict who can manage policies: a Key Vault Contributor can potentially create a policy that grants themselves data plane access. section 5.2.1
A narrowly scoped policy
The sample command grants one identity get access to certificates, get/list/import access to keys, and backup/restore access to secrets in azureSecKV01. The resulting JSON records those permissions under the identity’s object ID.
