Azure Security built-in role

Key Vault Crypto Officer

Performs all Key Vault key data-plane operations and manages key rotation policies, but cannot manage Azure RBAC permissions. Its control-plane Actions also create and manage classic metric alerts, deployments, and support tickets. It works only with vaults using the Azure RBAC permission model and does not grant secret or certificate administration.

Control-plane actions (10)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.KeyVault/checkNameAvailability/read
• Microsoft.KeyVault/deletedVaults/read
• Microsoft.KeyVault/locations/*/read
• Microsoft.KeyVault/vaults/*/read
• Microsoft.KeyVault/operations/read

Data-plane actions (2)

• Microsoft.KeyVault/vaults/keys/*
• Microsoft.KeyVault/vaults/keyrotationpolicies/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the individual vault for the key-management team. Parent-scope assignments are inherited by child vaults and extend the ancillary alert-rule, deployment, and support Actions across the parent scope. Key-level assignment is supported for exceptional isolation cases, but Microsoft recommends vault-per-application boundaries and vault-level role assignments for ordinary administration.

Common use cases (2)

• Create, import, rotate, enable, disable, back up, restore, delete, recover, or purge cryptographic keys.
• Manage key rotation policies and perform approved encrypt, decrypt, wrap, unwrap, sign, or verify operations during key administration.

Prerequisites (3)

• The vault must use Azure RBAC and the key type, protection level, purpose, rotation schedule, recovery plan, and owner must be defined.
• Confirm that a runtime cryptographic user role cannot meet the task without key lifecycle authority.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the vault scope.

Best practices (3)

• Separate keys by purpose, grant only required key operations, and automate rotation according to organizational policy.
• Assign the officer role at one vault, use eligible access for people, and use narrower runtime identities for cryptographic operations.
• Enable soft delete, purge protection, diagnostic logs, and alerts for backup, restore, release, deletion, and unusual key use.

Security considerations (3)

• The role can decrypt, unwrap, sign, back up, restore, delete, and purge keys, affecting confidentiality, integrity, and service availability.
• A restored key backup is independent of the original, so disabling or deleting the source key does not invalidate a restored copy.
• Key deletion or disablement can make dependent encrypted services unavailable; broad assignment also permits classic-alert, deployment, and support-ticket changes outside the key data plane.

Assignment guidance

Assign Key Vault Crypto Officer only to key lifecycle administrators at the vault scope. Use Key Vault Crypto User or Crypto Service Encryption User for workload operations, keep permission delegation separate, and require review for backup, restore, purge, or rotation-policy changes.

Related roles (2)

• Key Vault Crypto User: Microsoft documents Crypto User for cryptographic use and Crypto Officer for all key actions and rotation-policy management.
• Key Vault Crypto Service Encryption User: Narrower documented role for key metadata plus wrap and unwrap operations used by service encryption.

Editorial sources (6)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Secure your Azure Key Vault keys →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →