Azure Security built-in role
Key Vault Crypto Service Release User
Performs the Key Vault key release data-plane operation for Secure Key Release to an attested trusted execution environment. It works only with Azure RBAC-enabled vaults and does not grant ordinary encrypt, decrypt, wrap, unwrap, sign, key lifecycle, or role-assignment operations.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 08bbd89e-9f13-488c-ac41-acfcb10c90ab
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.KeyVault/vaults/keys/release/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign to the confidential workload identity at the individual exportable key when practical, or at the dedicated vault only when it must release multiple approved keys. Parent assignments are inherited. Secure Key Release is supported for Key Vault Premium and Managed HSM, but Managed HSM data-plane authorization uses its separate local RBAC model.
Common use cases (2)
- Release an HSM-protected exportable key to a confidential VM, enclave, or confidential container whose attestation claims satisfy the key release policy.
- Enable an approved confidential-computing workload to obtain raw key material only after Microsoft Azure Attestation and the release policy validate its TEE configuration.
Prerequisites (3)
- Create an exportable HSM-backed key with a Secure Key Release policy that specifies the required Microsoft Azure Attestation claims.
- Complete and validate the workload remote-attestation flow before attempting release.
- The vault must use Azure RBAC and the assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Assign at the individual key to the confidential workload managed identity and make the release policy as specific as the approved TEE configuration permits.
- Treat the Azure RBAC assignment and release policy as independent required controls; review changes to either one.
- Enable diagnostic logging and alert on unexpected KeyRelease principals, source addresses, failures, or release volume.
Security considerations (3)
- A successful release transfers raw key material out of Key Vault into the attested environment, so both identity authorization and attestation-policy integrity are critical.
- An overly permissive release policy can authorize an unintended TEE even when the Azure RBAC assignment is correctly scoped.
- Secure Key Release applies to keys, not certificates or secrets, and should not be described as ordinary Key Vault object read access.
Assignment guidance
Assign Key Vault Crypto Service Release User only to the confidential workload identity and preferably on one exportable key. Verify the Microsoft Azure Attestation claims and release policy, monitor KeyRelease events, and remove the assignment when the confidential workload is decommissioned.
Common questions
When should I assign the Key Vault Crypto Service Release User Azure role?
Assign Key Vault Crypto Service Release User when you need to: Release an HSM-protected exportable key to a confidential VM, enclave, or confidential container whose attestation claims satisfy the key release policy.; and Enable an approved confidential-computing workload to obtain raw key material only after Microsoft Azure Attestation and the release policy validate its TEE configuration.. Practical scope: Assign to the confidential workload identity at the individual exportable key when practical, or at the dedicated vault only when it must release multiple approved keys. Parent assignments are inherited. Secure Key Release is supported for Key Vault Premium and Managed HSM, but Managed HSM data-plane authorization uses its separate local RBAC model.
What permissions does the Key Vault Crypto Service Release User Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.KeyVault/vaults/keys/release/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Key Vault Crypto Service Release User Azure role?
Key considerations when assigning Key Vault Crypto Service Release User: A successful release transfers raw key material out of Key Vault into the attested environment, so both identity authorization and attestation-policy integrity are critical.; An overly permissive release policy can authorize an unintended TEE even when the Azure RBAC assignment is correctly scoped.; and Secure Key Release applies to keys, not certificates or secrets, and should not be described as ordinary Key Vault object read access.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Security →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Grant permission to applications to access an Azure key vault using Azure RBAC →
Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Secure your Azure Key Vault keys →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.
- Secure Key Release with Azure Key Vault and Azure Confidential Computing →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.