Azure Security built-in role

Key Vault Contributor

Manages Key Vault resources in the Azure control plane but does not grant Key Vault data-plane access to keys, secrets, or certificates. It can also create and manage classic metric alerts, deployments, and support tickets. The definition excludes Managed HSM resources and deleted-vault purge, and has no DataActions.

Control-plane actions (6)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.KeyVault/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (3)

• Microsoft.KeyVault/locations/deletedVaults/purge/action
• Microsoft.KeyVault/hsmPools/*
• Microsoft.KeyVault/managedHsms/*

Assignable scopes (1)

• /

Practical scope

Assign at an individual vault or the dedicated resource group containing the vaults the administrator manages. Parent-scope assignments are inherited by child vaults. The role governs vault lifecycle and configuration, while data-plane access requires a separate Key Vault role or a legacy access policy.

Common use cases (2)

• Create and manage vault configuration, tags, networking, diagnostics, deployments, and lifecycle without routine access to stored object contents.
• Operate vault infrastructure while a separate security team controls data-plane role assignments and object access.

Prerequisites (3)

• Identify the vaults and control-plane settings the administrator owns and confirm that Managed HSM administration is not part of the task.
• Choose and validate the Azure RBAC permission model before assigning separate data-plane roles.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Use the Azure RBAC permission model and keep control-plane management separate from data-plane object access.
• Assign on one vault or a dedicated vault resource group rather than at subscription scope.
• Protect vault deletion with soft delete and purge protection, restrict network exposure, and monitor control-plane changes.

Security considerations (3)

• The role can change or delete vault resources and alter networking or authorization configuration, causing outage or changing the data-access boundary.
• On a vault using legacy access policies, a principal with vault control-plane write authority can grant itself data-plane access by changing an access policy.
• No DataActions are present, but broad scope also grants classic-alert, deployment, and support-ticket changes and does not grant Managed HSM key access.

Assignment guidance

Assign Key Vault Contributor to vault infrastructure administrators at the individual vault or dedicated resource-group scope. Use Azure RBAC rather than legacy access policies, grant data-plane roles separately, and use Managed HSM contributor only for Managed HSM control-plane lifecycle.

Related roles (2)

• Key Vault Administrator: Microsoft explicitly distinguishes Contributor control-plane management from Administrator data-plane access to keys, secrets, and certificates.
• Managed HSM contributor: The Key Vault Contributor definition excludes Managed HSM resources; Managed HSM contributor is the separate control-plane role for those resources.

Editorial sources (6)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Secure your Azure Key Vault →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →