Azure Security built-in role

Key Vault Certificates Officer

Performs certificate data-plane lifecycle operations in a Key Vault, including certificate, issuer, and contact management, but cannot manage Azure RBAC permissions. Its control-plane Actions also create and manage classic metric alerts, deployments, and support tickets. It works only with vaults using the Azure RBAC permission model and does not grant general secret or key administration.

Control-plane actions (10)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.KeyVault/checkNameAvailability/read
• Microsoft.KeyVault/deletedVaults/read
• Microsoft.KeyVault/locations/*/read
• Microsoft.KeyVault/vaults/*/read
• Microsoft.KeyVault/operations/read

Data-plane actions (3)

• Microsoft.KeyVault/vaults/certificatecas/*
• Microsoft.KeyVault/vaults/certificates/*
• Microsoft.KeyVault/vaults/certificatecontacts/write

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the individual vault whose certificate lifecycle the principal owns. Parent-scope assignments are inherited by all child vaults and also extend the ancillary alert-rule, deployment, and support Actions across the parent scope. Object-level assignments do not cover vault-wide issuer, contact, monitoring, or administrative workflows. Microsoft recommends separate vaults by application and environment.

Common use cases (2)

• Create, import, renew, update, back up, restore, delete, recover, or purge certificates under an approved certificate lifecycle process.
• Manage certificate issuers, policies, contacts, and renewal configuration for one vault.

Prerequisites (3)

• The vault must use Azure RBAC and the certificate authority, requester credentials, certificate policy, and ownership process must be defined.
• Confirm that the principal needs lifecycle management rather than only certificate retrieval.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the vault scope.

Best practices (3)

• Use certificate objects rather than storing certificates as generic secrets, and automate renewal well before expiration.
• Assign at the vault scope to the certificate-management team and use managed identities for applications that only consume certificates.
• Limit exportable private keys, enable audit logging, soft delete, purge protection, and alerts for access, deletion, expiry, and renewal failures.

Security considerations (3)

• Certificate lifecycle authority can issue, replace, delete, recover, back up, restore, or purge certificates trusted by production services.
• Issuer credentials and certificate policies influence who issues certificates and how private keys are generated or exported.
• The role cannot manage role assignments, but compromise can still cause certificate substitution, outage, unauthorized issuance, or ancillary classic-alert, deployment, and support-ticket changes at a broad assignment scope.

Assignment guidance

Assign Key Vault Certificates Officer at the vault scope to the team responsible for certificate issuance and renewal. Keep runtime certificate retrieval on Key Vault Certificate User, retain permission delegation with a separate administrator, and use eligible access for human officers where available.

Related roles (2)

• Key Vault Certificate User: Microsoft documents Certificate User for reading complete certificate content and Certificates Officer for lifecycle management.
• Key Vault Administrator: Administrator adds all key and secret data-plane operations when certificate data-plane administration is insufficient.

Editorial sources (7)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• About Azure Key Vault certificates →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

• Secure your Azure Key Vault certificates →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →