Azure Security built-in role
Key Vault Crypto Service Encryption User
Reads Key Vault key metadata and performs wrap and unwrap data-plane operations for service-encryption scenarios. It also manages the Event Grid subscriptions exposed by the built-in definition, has no general key lifecycle authority, and works only with vaults using Azure RBAC.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: e147488a-f6f5-4113-8e2d-b22465e65bf6
Control-plane actions (3)
Microsoft.EventGrid/eventSubscriptions/writeMicrosoft.EventGrid/eventSubscriptions/readMicrosoft.EventGrid/eventSubscriptions/delete
Data-plane actions (3)
Microsoft.KeyVault/vaults/keys/readMicrosoft.KeyVault/vaults/keys/wrap/actionMicrosoft.KeyVault/vaults/keys/unwrap/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign to the managed identity of the Azure service at the individual key or vault scope documented by that service. Parent assignments are inherited by child vaults and keys. Microsoft recommends a vault per application and environment rather than broad shared-vault access.
Common use cases (2)
- Allow an Azure service identity to wrap and unwrap its data-encryption keys with a customer-managed Key Vault key.
- Read the key metadata required by a service-encryption integration without granting key creation, deletion, signing, or general decrypt operations.
Prerequisites (3)
- The vault must use Azure RBAC and the customer-managed key must exist with a key type and lifecycle supported by the consuming service.
- Use the service or workload managed identity documented for the encryption integration.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target key or vault scope.
Best practices (3)
- Assign to the consuming service identity rather than to human users and scope to the exact key where the service supports key-level assignment.
- Use a separate key for each encryption purpose and maintain rotation procedures that preserve access to older encrypted data.
- Monitor wrap, unwrap, key access, and Event Grid subscription changes and remove assignments when the encrypted resource is retired.
Security considerations (3)
- Unwrap authority can reveal the plaintext data-encryption key to the authorized service or a compromised caller acting as that identity.
- Removing, disabling, deleting, or rotating the key incorrectly can make the dependent service data unavailable.
- Key read exposes public material for asymmetric keys but does not expose private or symmetric key material. The role does not grant general key management, but unwrap remains sensitive data-plane cryptographic authority.
Assignment guidance
Assign Key Vault Crypto Service Encryption User to the documented service managed identity at the key or vault scope required by the integration. Do not use it as a general human crypto role, and validate encryption, rotation, logging, and recovery before removing prior key access.
Common questions
When should I assign the Key Vault Crypto Service Encryption User Azure role?
Assign Key Vault Crypto Service Encryption User when you need to: Allow an Azure service identity to wrap and unwrap its data-encryption keys with a customer-managed Key Vault key.; and Read the key metadata required by a service-encryption integration without granting key creation, deletion, signing, or general decrypt operations.. Practical scope: Assign to the managed identity of the Azure service at the individual key or vault scope documented by that service. Parent assignments are inherited by child vaults and keys. Microsoft recommends a vault per application and environment rather than broad shared-vault access.
What permissions does the Key Vault Crypto Service Encryption User Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.EventGrid/eventSubscriptions/write; Microsoft.EventGrid/eventSubscriptions/read; Microsoft.EventGrid/eventSubscriptions/delete; Microsoft.KeyVault/vaults/keys/read; Microsoft.KeyVault/vaults/keys/wrap/action; and Microsoft.KeyVault/vaults/keys/unwrap/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Key Vault Crypto Service Encryption User Azure role?
Key considerations when assigning Key Vault Crypto Service Encryption User: Unwrap authority can reveal the plaintext data-encryption key to the authorized service or a compromised caller acting as that identity.; Removing, disabling, deleting, or rotating the key incorrectly can make the dependent service data unavailable.; and Key read exposes public material for asymmetric keys but does not expose private or symmetric key material. The role does not grant general key management, but unwrap remains sensitive data-plane cryptographic authority.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Security →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Grant permission to applications to access an Azure key vault using Azure RBAC →
Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Secure your Azure Key Vault keys →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.