Azure Security built-in role

Key Vault Certificate User

Reads a Key Vault certificate and its complete certificate content, including the addressable secret and key portions exposed by the role. For an exportable certificate, the secret can contain the private key in PFX or PEM form; a non-exportable certificate does not return its private key. The role works only with the Azure RBAC permission model.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (4)

• Microsoft.KeyVault/vaults/certificates/read
• Microsoft.KeyVault/vaults/secrets/getSecret/action
• Microsoft.KeyVault/vaults/secrets/readMetadata/action
• Microsoft.KeyVault/vaults/keys/read

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the individual vault for an application that consumes certificates from that vault. Parent-scope assignments are inherited by child vaults. A certificate-level assignment is possible for a documented exception, but Microsoft recommends vault-per-application boundaries rather than routine object-level isolation.

Common use cases (2)

• Allow a managed workload to retrieve an approved certificate, certificate secret, and associated public-key information for TLS or authentication.
• Read an exportable certificate package when the application is explicitly authorized to receive the private key.

Prerequisites (3)

• The vault must use Azure RBAC and the certificate must already exist.
• If the workload needs the private key, the certificate policy must make that key exportable; HSM-protected certificate keys are non-exportable.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Assign the role to a managed identity rather than embedding application credentials.
• Use a separate vault per application and environment and avoid exportable private keys when the workload can perform key operations in Key Vault.
• Monitor certificate and secret retrieval, maintain an owner and expiration inventory, and automate renewal.

Security considerations (3)

• For exportable certificates, the role can retrieve private-key material through the certificate secret and must be treated as sensitive content access.
• A copied private key can be used outside Key Vault and is not revoked merely by removing the Azure role assignment.
• The role does not manage certificate lifecycle or Azure RBAC permissions, but its read authority is still highly privileged.

Assignment guidance

Assign Key Vault Certificate User to the consuming workload identity at the vault scope only after confirming that complete certificate content is required. Use Key Vault Reader for Key Vault data-plane metadata inspection while accounting for its ancillary control-plane Actions, and use Key Vault Certificates Officer for lifecycle administration.

Related roles (2)

• Key Vault Certificates Officer: Microsoft separates certificate-content use from certificate lifecycle administration; Officer creates and manages certificates while Certificate User reads complete certificate content.
• Key Vault Reader: Limits Key Vault data-plane access to metadata and cannot read secret contents or key material, though its definition also includes classic-alert and support-ticket control-plane Actions.

Editorial sources (7)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• About Azure Key Vault certificates →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

• Secure your Azure Key Vault certificates →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →