Azure Security built-in role

Key Vault Crypto User

Uses Key Vault keys for cryptographic operations. The published definition includes key read, update, backup, encrypt, decrypt, wrap, unwrap, sign, and verify DataActions, but not key creation, deletion, purge, rotation-policy management, or Azure RBAC permission management. It requires the Azure RBAC permission model.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (9)

• Microsoft.KeyVault/vaults/keys/read
• Microsoft.KeyVault/vaults/keys/update/action
• Microsoft.KeyVault/vaults/keys/backup/action
• Microsoft.KeyVault/vaults/keys/encrypt/action
• Microsoft.KeyVault/vaults/keys/decrypt/action
• Microsoft.KeyVault/vaults/keys/wrap/action
• Microsoft.KeyVault/vaults/keys/unwrap/action
• Microsoft.KeyVault/vaults/keys/sign/action
• Microsoft.KeyVault/vaults/keys/verify/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign to the workload identity at the individual key or dedicated vault. Parent assignments are inherited by child vaults and keys. Use a separate vault per application and environment, and use object-level assignment only when the documented exception is preferable to a separate vault boundary.

Common use cases (2)

• Allow an application to encrypt and decrypt data or wrap and unwrap data-encryption keys with an existing Key Vault key.
• Allow a workload to sign and verify data with an existing key while keeping key creation and deletion with a separate officer.

Prerequisites (3)

• The vault must use Azure RBAC and the approved key must already exist with operations compatible with the workload.
• Use a managed identity and define how the workload handles key versions, rotation, outage, and recovery.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target key or vault scope.

Best practices (3)

• Assign to a workload managed identity and limit scope to the exact key or dedicated vault.
• Separate keys by encryption and signing purpose, rotate them regularly, and monitor operation baselines and failures.
• Review whether the built-in backup and update permissions are required; use a custom role when the application needs a smaller operation set.

Security considerations (3)

• Decrypt, unwrap, and sign operations can expose protected data or produce trusted signatures if the workload identity is compromised.
• Key backup can create material that may be restored as an independent copy, which is broader than routine cryptographic use.
• The role cannot create or delete keys or assign permissions, but it is still privileged data-plane access to cryptographic operations.

Assignment guidance

Assign Key Vault Crypto User to the application managed identity at the key or dedicated vault scope only when its full published operation set is required. Use Crypto Service Encryption User for service-encryption metadata and wrap/unwrap operations, and Crypto Officer for approved key lifecycle administration.

Related roles (2)

• Key Vault Crypto Service Encryption User: Microsoft documents the service-encryption role as the narrower key-metadata and wrap/unwrap option.
• Key Vault Crypto Officer: Adds all key lifecycle and rotation-policy operations when cryptographic use alone is insufficient.

Editorial sources (6)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Secure your Azure Key Vault keys →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →