Azure Security built-in role
Key Vault Crypto User
Uses Key Vault keys for cryptographic operations. The published definition includes key read, update, backup, encrypt, decrypt, wrap, unwrap, sign, and verify DataActions, but not key creation, deletion, purge, rotation-policy management, or Azure RBAC permission management. It requires the Azure RBAC permission model.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 12338af0-0e69-4776-bea7-57ae8d297424
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (9)
Microsoft.KeyVault/vaults/keys/readMicrosoft.KeyVault/vaults/keys/update/actionMicrosoft.KeyVault/vaults/keys/backup/actionMicrosoft.KeyVault/vaults/keys/encrypt/actionMicrosoft.KeyVault/vaults/keys/decrypt/actionMicrosoft.KeyVault/vaults/keys/wrap/actionMicrosoft.KeyVault/vaults/keys/unwrap/actionMicrosoft.KeyVault/vaults/keys/sign/actionMicrosoft.KeyVault/vaults/keys/verify/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign to the workload identity at the individual key or dedicated vault. Parent assignments are inherited by child vaults and keys. Use a separate vault per application and environment, and use object-level assignment only when the documented exception is preferable to a separate vault boundary.
Common use cases (2)
- Allow an application to encrypt and decrypt data or wrap and unwrap data-encryption keys with an existing Key Vault key.
- Allow a workload to sign and verify data with an existing key while keeping key creation and deletion with a separate officer.
Prerequisites (3)
- The vault must use Azure RBAC and the approved key must already exist with operations compatible with the workload.
- Use a managed identity and define how the workload handles key versions, rotation, outage, and recovery.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target key or vault scope.
Best practices (3)
- Assign to a workload managed identity and limit scope to the exact key or dedicated vault.
- Separate keys by encryption and signing purpose, rotate them regularly, and monitor operation baselines and failures.
- Review whether the built-in backup and update permissions are required; use a custom role when the application needs a smaller operation set.
Security considerations (3)
- Decrypt, unwrap, and sign operations can expose protected data or produce trusted signatures if the workload identity is compromised.
- Key backup can create material that may be restored as an independent copy, which is broader than routine cryptographic use.
- The role cannot create or delete keys or assign permissions, but it is still privileged data-plane access to cryptographic operations.
Assignment guidance
Assign Key Vault Crypto User to the application managed identity at the key or dedicated vault scope only when its full published operation set is required. Use Crypto Service Encryption User for service-encryption metadata and wrap/unwrap operations, and Crypto Officer for approved key lifecycle administration.
Related roles (2)
- Key Vault Crypto Service Encryption User: Microsoft documents the service-encryption role as the narrower key-metadata and wrap/unwrap option.
- Key Vault Crypto Officer: Adds all key lifecycle and rotation-policy operations when cryptographic use alone is insufficient.
Common questions
When should I assign the Key Vault Crypto User Azure role?
Assign Key Vault Crypto User when you need to: Allow an application to encrypt and decrypt data or wrap and unwrap data-encryption keys with an existing Key Vault key.; and Allow a workload to sign and verify data with an existing key while keeping key creation and deletion with a separate officer.. Practical scope: Assign to the workload identity at the individual key or dedicated vault. Parent assignments are inherited by child vaults and keys. Use a separate vault per application and environment, and use object-level assignment only when the documented exception is preferable to a separate vault boundary.
What permissions does the Key Vault Crypto User Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.KeyVault/vaults/keys/read; Microsoft.KeyVault/vaults/keys/update/action; Microsoft.KeyVault/vaults/keys/backup/action; Microsoft.KeyVault/vaults/keys/encrypt/action; Microsoft.KeyVault/vaults/keys/decrypt/action; and Microsoft.KeyVault/vaults/keys/wrap/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Key Vault Crypto User Azure role?
Key considerations when assigning Key Vault Crypto User: Decrypt, unwrap, and sign operations can expose protected data or produce trusted signatures if the workload identity is compromised.; Key backup can create material that may be restored as an independent copy, which is broader than routine cryptographic use.; and The role cannot create or delete keys or assign permissions, but it is still privileged data-plane access to cryptographic operations.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Security →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Grant permission to applications to access an Azure key vault using Azure RBAC →
Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Secure your Azure Key Vault keys →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.