Azure Security built-in role

Key Vault Crypto Service Encryption User

Reads Key Vault key metadata and performs wrap and unwrap data-plane operations for service-encryption scenarios. It also manages the Event Grid subscriptions exposed by the built-in definition, has no general key lifecycle authority, and works only with vaults using Azure RBAC.

Control-plane actions (3)

• Microsoft.EventGrid/eventSubscriptions/write
• Microsoft.EventGrid/eventSubscriptions/read
• Microsoft.EventGrid/eventSubscriptions/delete

Data-plane actions (3)

• Microsoft.KeyVault/vaults/keys/read
• Microsoft.KeyVault/vaults/keys/wrap/action
• Microsoft.KeyVault/vaults/keys/unwrap/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign to the managed identity of the Azure service at the individual key or vault scope documented by that service. Parent assignments are inherited by child vaults and keys. Microsoft recommends a vault per application and environment rather than broad shared-vault access.

Common use cases (2)

• Allow an Azure service identity to wrap and unwrap its data-encryption keys with a customer-managed Key Vault key.
• Read the key metadata required by a service-encryption integration without granting key creation, deletion, signing, or general decrypt operations.

Prerequisites (3)

• The vault must use Azure RBAC and the customer-managed key must exist with a key type and lifecycle supported by the consuming service.
• Use the service or workload managed identity documented for the encryption integration.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target key or vault scope.

Best practices (3)

• Assign to the consuming service identity rather than to human users and scope to the exact key where the service supports key-level assignment.
• Use a separate key for each encryption purpose and maintain rotation procedures that preserve access to older encrypted data.
• Monitor wrap, unwrap, key access, and Event Grid subscription changes and remove assignments when the encrypted resource is retired.

Security considerations (3)

• Unwrap authority can reveal the plaintext data-encryption key to the authorized service or a compromised caller acting as that identity.
• Removing, disabling, deleting, or rotating the key incorrectly can make the dependent service data unavailable.
• Key read exposes public material for asymmetric keys but does not expose private or symmetric key material. The role does not grant general key management, but unwrap remains sensitive data-plane cryptographic authority.

Assignment guidance

Assign Key Vault Crypto Service Encryption User to the documented service managed identity at the key or vault scope required by the integration. Do not use it as a general human crypto role, and validate encryption, rotation, logging, and recovery before removing prior key access.

Editorial sources (6)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Secure your Azure Key Vault keys →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →