Azure Security built-in role

Key Vault Crypto Service Release User

Performs the Key Vault key release data-plane operation for Secure Key Release to an attested trusted execution environment. It works only with Azure RBAC-enabled vaults and does not grant ordinary encrypt, decrypt, wrap, unwrap, sign, key lifecycle, or role-assignment operations.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (1)

• Microsoft.KeyVault/vaults/keys/release/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign to the confidential workload identity at the individual exportable key when practical, or at the dedicated vault only when it must release multiple approved keys. Parent assignments are inherited. Secure Key Release is supported for Key Vault Premium and Managed HSM, but Managed HSM data-plane authorization uses its separate local RBAC model.

Common use cases (2)

• Release an HSM-protected exportable key to a confidential VM, enclave, or confidential container whose attestation claims satisfy the key release policy.
• Enable an approved confidential-computing workload to obtain raw key material only after Microsoft Azure Attestation and the release policy validate its TEE configuration.

Prerequisites (3)

• Create an exportable HSM-backed key with a Secure Key Release policy that specifies the required Microsoft Azure Attestation claims.
• Complete and validate the workload remote-attestation flow before attempting release.
• The vault must use Azure RBAC and the assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Assign at the individual key to the confidential workload managed identity and make the release policy as specific as the approved TEE configuration permits.
• Treat the Azure RBAC assignment and release policy as independent required controls; review changes to either one.
• Enable diagnostic logging and alert on unexpected KeyRelease principals, source addresses, failures, or release volume.

Security considerations (3)

• A successful release transfers raw key material out of Key Vault into the attested environment, so both identity authorization and attestation-policy integrity are critical.
• An overly permissive release policy can authorize an unintended TEE even when the Azure RBAC assignment is correctly scoped.
• Secure Key Release applies to keys, not certificates or secrets, and should not be described as ordinary Key Vault object read access.

Assignment guidance

Assign Key Vault Crypto Service Release User only to the confidential workload identity and preferably on one exportable key. Verify the Microsoft Azure Attestation claims and release policy, monitor KeyRelease events, and remove the assignment when the confidential workload is decommissioned.

Editorial sources (7)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Secure your Azure Key Vault keys →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

• Secure Key Release with Azure Key Vault and Azure Confidential Computing →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →