Azure Security built-in role
Key Vault Administrator
Performs all Key Vault data-plane operations on a vault and every key, secret, and certificate in it. It cannot write the Key Vault resource or Azure RBAC role assignments, but its control-plane Actions can create and manage classic metric alerts, deployments, and support tickets. It works only on vaults that use the Azure RBAC permission model.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 00482a5a-887f-4fb3-b363-3b7fe8e74483
Control-plane actions (10)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*Microsoft.KeyVault/checkNameAvailability/readMicrosoft.KeyVault/deletedVaults/readMicrosoft.KeyVault/locations/*/readMicrosoft.KeyVault/vaults/*/readMicrosoft.KeyVault/operations/read
Data-plane actions (1)
Microsoft.KeyVault/vaults/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft recommends a vault per application and environment with data-plane roles assigned at the vault scope. Azure RBAC assignments at a parent scope are inherited by child vaults. At resource-group or broader scope, the ancillary alert-rule, deployment, and support Actions also apply throughout that scope. Object-level assignments are supported only for limited scenarios and are not a substitute for a separate vault security boundary.
Common use cases (2)
- Administer the complete lifecycle of keys, secrets, certificates, issuers, contacts, backups, recovery, and rotation inside one approved vault.
- Perform an exceptional recovery or migration operation that genuinely requires authority across every Key Vault object type.
Prerequisites (3)
- The target vault must use the Azure RBAC permission model; changing from access policies requires separate unrestricted role-assignment and vault-write authority.
- Confirm that separate key, secret, or certificate officer roles cannot meet the task.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Reserve this role for a very small set of vault administrators and use narrower object-type roles for ordinary operations.
- Assign at the individual vault, use eligible just-in-time access for people, and separate vaults by application and environment.
- Enable private network access where appropriate, diagnostic logging, soft delete, purge protection, and rotation for cryptographic assets.
Security considerations (3)
- The role can read secret contents, use and manage keys, export eligible certificate private keys, and delete, recover, back up, restore, or purge protected objects.
- Key backup and restore can create an independent copy; disabling or deleting the original does not invalidate a restored copy.
- The role cannot assign Azure roles or write the vault resource, but a broad parent-scope assignment also permits classic-alert, deployment, and support-ticket changes outside the Key Vault data plane.
Assignment guidance
Assign Key Vault Administrator only at the vault scope and only when one principal must administer all three object types. Prefer Certificates Officer, Crypto Officer, Secrets Officer, or a runtime user role for narrower duties, and keep Key Vault Contributor and role-assignment authority separate.
Related roles (2)
- Key Vault Contributor: Microsoft documents Contributor for the vault control plane and Administrator for all vault data-plane objects; neither role includes the other plane.
- Key Vault Data Access Administrator: Separately delegates the conditioned set of Key Vault data-plane role assignments and does not grant object access itself.
Common questions
When should I assign the Key Vault Administrator Azure role?
Assign Key Vault Administrator when you need to: Administer the complete lifecycle of keys, secrets, certificates, issuers, contacts, backups, recovery, and rotation inside one approved vault.; and Perform an exceptional recovery or migration operation that genuinely requires authority across every Key Vault object type.. Practical scope: Microsoft recommends a vault per application and environment with data-plane roles assigned at the vault scope. Azure RBAC assignments at a parent scope are inherited by child vaults. At resource-group or broader scope, the ancillary alert-rule, deployment, and support Actions also apply throughout that scope. Object-level assignments are supported only for limited scenarios and are not a substitute for a separate vault security boundary.
What permissions does the Key Vault Administrator Azure role grant?
The role definition grants 11 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Support/*; and Microsoft.KeyVault/checkNameAvailability/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Key Vault Administrator Azure role?
Key considerations when assigning Key Vault Administrator: The role can read secret contents, use and manage keys, export eligible certificate private keys, and delete, recover, back up, restore, or purge protected objects.; Key backup and restore can create an independent copy; disabling or deleting the original does not invalidate a restored copy.; and The role cannot assign Azure roles or write the vault resource, but a broad parent-scope assignment also permits classic-alert, deployment, and support-ticket changes outside the Key Vault data plane.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Security →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Grant permission to applications to access an Azure key vault using Azure RBAC →
Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Secure your Azure Key Vault →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.