Azure Security built-in role

Key Vault Administrator

Performs all Key Vault data-plane operations on a vault and every key, secret, and certificate in it. It cannot write the Key Vault resource or Azure RBAC role assignments, but its control-plane Actions can create and manage classic metric alerts, deployments, and support tickets. It works only on vaults that use the Azure RBAC permission model.

Control-plane actions (10)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.KeyVault/checkNameAvailability/read
• Microsoft.KeyVault/deletedVaults/read
• Microsoft.KeyVault/locations/*/read
• Microsoft.KeyVault/vaults/*/read
• Microsoft.KeyVault/operations/read

Data-plane actions (1)

• Microsoft.KeyVault/vaults/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Microsoft recommends a vault per application and environment with data-plane roles assigned at the vault scope. Azure RBAC assignments at a parent scope are inherited by child vaults. At resource-group or broader scope, the ancillary alert-rule, deployment, and support Actions also apply throughout that scope. Object-level assignments are supported only for limited scenarios and are not a substitute for a separate vault security boundary.

Common use cases (2)

• Administer the complete lifecycle of keys, secrets, certificates, issuers, contacts, backups, recovery, and rotation inside one approved vault.
• Perform an exceptional recovery or migration operation that genuinely requires authority across every Key Vault object type.

Prerequisites (3)

• The target vault must use the Azure RBAC permission model; changing from access policies requires separate unrestricted role-assignment and vault-write authority.
• Confirm that separate key, secret, or certificate officer roles cannot meet the task.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Reserve this role for a very small set of vault administrators and use narrower object-type roles for ordinary operations.
• Assign at the individual vault, use eligible just-in-time access for people, and separate vaults by application and environment.
• Enable private network access where appropriate, diagnostic logging, soft delete, purge protection, and rotation for cryptographic assets.

Security considerations (3)

• The role can read secret contents, use and manage keys, export eligible certificate private keys, and delete, recover, back up, restore, or purge protected objects.
• Key backup and restore can create an independent copy; disabling or deleting the original does not invalidate a restored copy.
• The role cannot assign Azure roles or write the vault resource, but a broad parent-scope assignment also permits classic-alert, deployment, and support-ticket changes outside the Key Vault data plane.

Assignment guidance

Assign Key Vault Administrator only at the vault scope and only when one principal must administer all three object types. Prefer Certificates Officer, Crypto Officer, Secrets Officer, or a runtime user role for narrower duties, and keep Key Vault Contributor and role-assignment authority separate.

Related roles (2)

• Key Vault Contributor: Microsoft documents Contributor for the vault control plane and Administrator for all vault data-plane objects; neither role includes the other plane.
• Key Vault Data Access Administrator: Separately delegates the conditioned set of Key Vault data-plane role assignments and does not grant object access itself.

Editorial sources (6)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Secure your Azure Key Vault →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →