Azure Security built-in role
Key Vault Certificate User
Reads a Key Vault certificate and its complete certificate content, including the addressable secret and key portions exposed by the role. For an exportable certificate, the secret can contain the private key in PFX or PEM form; a non-exportable certificate does not return its private key. The role works only with the Azure RBAC permission model.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: db79e9a7-68ee-4b58-9aeb-b90e7c24fcba
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (4)
Microsoft.KeyVault/vaults/certificates/readMicrosoft.KeyVault/vaults/secrets/getSecret/actionMicrosoft.KeyVault/vaults/secrets/readMetadata/actionMicrosoft.KeyVault/vaults/keys/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the individual vault for an application that consumes certificates from that vault. Parent-scope assignments are inherited by child vaults. A certificate-level assignment is possible for a documented exception, but Microsoft recommends vault-per-application boundaries rather than routine object-level isolation.
Common use cases (2)
- Allow a managed workload to retrieve an approved certificate, certificate secret, and associated public-key information for TLS or authentication.
- Read an exportable certificate package when the application is explicitly authorized to receive the private key.
Prerequisites (3)
- The vault must use Azure RBAC and the certificate must already exist.
- If the workload needs the private key, the certificate policy must make that key exportable; HSM-protected certificate keys are non-exportable.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Assign the role to a managed identity rather than embedding application credentials.
- Use a separate vault per application and environment and avoid exportable private keys when the workload can perform key operations in Key Vault.
- Monitor certificate and secret retrieval, maintain an owner and expiration inventory, and automate renewal.
Security considerations (3)
- For exportable certificates, the role can retrieve private-key material through the certificate secret and must be treated as sensitive content access.
- A copied private key can be used outside Key Vault and is not revoked merely by removing the Azure role assignment.
- The role does not manage certificate lifecycle or Azure RBAC permissions, but its read authority is still highly privileged.
Assignment guidance
Assign Key Vault Certificate User to the consuming workload identity at the vault scope only after confirming that complete certificate content is required. Use Key Vault Reader for Key Vault data-plane metadata inspection while accounting for its ancillary control-plane Actions, and use Key Vault Certificates Officer for lifecycle administration.
Related roles (2)
- Key Vault Certificates Officer: Microsoft separates certificate-content use from certificate lifecycle administration; Officer creates and manages certificates while Certificate User reads complete certificate content.
- Key Vault Reader: Limits Key Vault data-plane access to metadata and cannot read secret contents or key material, though its definition also includes classic-alert and support-ticket control-plane Actions.
Common questions
When should I assign the Key Vault Certificate User Azure role?
Assign Key Vault Certificate User when you need to: Allow a managed workload to retrieve an approved certificate, certificate secret, and associated public-key information for TLS or authentication.; and Read an exportable certificate package when the application is explicitly authorized to receive the private key.. Practical scope: Assign at the individual vault for an application that consumes certificates from that vault. Parent-scope assignments are inherited by child vaults. A certificate-level assignment is possible for a documented exception, but Microsoft recommends vault-per-application boundaries rather than routine object-level isolation.
What permissions does the Key Vault Certificate User Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.KeyVault/vaults/certificates/read; Microsoft.KeyVault/vaults/secrets/getSecret/action; Microsoft.KeyVault/vaults/secrets/readMetadata/action; and Microsoft.KeyVault/vaults/keys/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Key Vault Certificate User Azure role?
Key considerations when assigning Key Vault Certificate User: For exportable certificates, the role can retrieve private-key material through the certificate secret and must be treated as sensitive content access.; A copied private key can be used outside Key Vault and is not revoked merely by removing the Azure role assignment.; and The role does not manage certificate lifecycle or Azure RBAC permissions, but its read authority is still highly privileged.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Security →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Grant permission to applications to access an Azure key vault using Azure RBAC →
Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- About Azure Key Vault certificates →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.
- Secure your Azure Key Vault certificates →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.