Azure Security built-in role
Key Vault Contributor
Manages Key Vault resources in the Azure control plane but does not grant Key Vault data-plane access to keys, secrets, or certificates. It can also create and manage classic metric alerts, deployments, and support tickets. The definition excludes Managed HSM resources and deleted-vault purge, and has no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f25e0fa2-a7c8-4377-a976-54943a77a395
Control-plane actions (6)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.KeyVault/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (3)
Microsoft.KeyVault/locations/deletedVaults/purge/actionMicrosoft.KeyVault/hsmPools/*Microsoft.KeyVault/managedHsms/*
Assignable scopes (1)
/
Practical scope
Assign at an individual vault or the dedicated resource group containing the vaults the administrator manages. Parent-scope assignments are inherited by child vaults. The role governs vault lifecycle and configuration, while data-plane access requires a separate Key Vault role or a legacy access policy.
Common use cases (2)
- Create and manage vault configuration, tags, networking, diagnostics, deployments, and lifecycle without routine access to stored object contents.
- Operate vault infrastructure while a separate security team controls data-plane role assignments and object access.
Prerequisites (3)
- Identify the vaults and control-plane settings the administrator owns and confirm that Managed HSM administration is not part of the task.
- Choose and validate the Azure RBAC permission model before assigning separate data-plane roles.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Use the Azure RBAC permission model and keep control-plane management separate from data-plane object access.
- Assign on one vault or a dedicated vault resource group rather than at subscription scope.
- Protect vault deletion with soft delete and purge protection, restrict network exposure, and monitor control-plane changes.
Security considerations (3)
- The role can change or delete vault resources and alter networking or authorization configuration, causing outage or changing the data-access boundary.
- On a vault using legacy access policies, a principal with vault control-plane write authority can grant itself data-plane access by changing an access policy.
- No DataActions are present, but broad scope also grants classic-alert, deployment, and support-ticket changes and does not grant Managed HSM key access.
Assignment guidance
Assign Key Vault Contributor to vault infrastructure administrators at the individual vault or dedicated resource-group scope. Use Azure RBAC rather than legacy access policies, grant data-plane roles separately, and use Managed HSM contributor only for Managed HSM control-plane lifecycle.
Related roles (2)
- Key Vault Administrator: Microsoft explicitly distinguishes Contributor control-plane management from Administrator data-plane access to keys, secrets, and certificates.
- Managed HSM contributor: The Key Vault Contributor definition excludes Managed HSM resources; Managed HSM contributor is the separate control-plane role for those resources.
Common questions
When should I assign the Key Vault Contributor Azure role?
Assign Key Vault Contributor when you need to: Create and manage vault configuration, tags, networking, diagnostics, deployments, and lifecycle without routine access to stored object contents.; and Operate vault infrastructure while a separate security team controls data-plane role assignments and object access.. Practical scope: Assign at an individual vault or the dedicated resource group containing the vaults the administrator manages. Parent-scope assignments are inherited by child vaults. The role governs vault lifecycle and configuration, while data-plane access requires a separate Key Vault role or a legacy access policy.
What permissions does the Key Vault Contributor Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.KeyVault/*; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Support/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Key Vault Contributor Azure role?
Key considerations when assigning Key Vault Contributor: The role can change or delete vault resources and alter networking or authorization configuration, causing outage or changing the data-access boundary.; On a vault using legacy access policies, a principal with vault control-plane write authority can grant itself data-plane access by changing an access policy.; and No DataActions are present, but broad scope also grants classic-alert, deployment, and support-ticket changes and does not grant Managed HSM key access.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Security →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Grant permission to applications to access an Azure key vault using Azure RBAC →
Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Secure your Azure Key Vault →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.